NVD

CVE-2024-53166 Detail

Modified After Enrichment

This CVE record has been updated after NVD enrichment efforts were completed. Enrichment data supplied by the NVD may require amendment due to these changes.

Description

In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix bfqq uaf in bfq_limit_depth() Set new allocated bfqq to bic or remove freed bfqq from bic are both protected by bfqd->lock, however bfq_limit_depth() is deferencing bfqq from bic without the lock, this can lead to UAF if the io_context is shared by multiple tasks. For example, test bfq with io_uring can trigger following UAF in v6.6: ================================================================== BUG: KASAN: slab-use-after-free in bfqq_group+0x15/0x50 Call Trace: <TASK> dump_stack_lvl+0x47/0x80 print_address_description.constprop.0+0x66/0x300 print_report+0x3e/0x70 kasan_report+0xb4/0xf0 bfqq_group+0x15/0x50 bfqq_request_over_limit+0x130/0x9a0 bfq_limit_depth+0x1b5/0x480 __blk_mq_alloc_requests+0x2b5/0xa00 blk_mq_get_new_requests+0x11d/0x1d0 blk_mq_submit_bio+0x286/0xb00 submit_bio_noacct_nocheck+0x331/0x400 __block_write_full_folio+0x3d0/0x640 writepage_cb+0x3b/0xc0 write_cache_pages+0x254/0x6c0 write_cache_pages+0x254/0x6c0 do_writepages+0x192/0x310 filemap_fdatawrite_wbc+0x95/0xc0 __filemap_fdatawrite_range+0x99/0xd0 filemap_write_and_wait_range.part.0+0x4d/0xa0 blkdev_read_iter+0xef/0x1e0 io_read+0x1b6/0x8a0 io_issue_sqe+0x87/0x300 io_wq_submit_work+0xeb/0x390 io_worker_handle_work+0x24d/0x550 io_wq_worker+0x27f/0x6c0 ret_from_fork_asm+0x1b/0x30 </TASK> Allocated by task 808602: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_slab_alloc+0x83/0x90 kmem_cache_alloc_node+0x1b1/0x6d0 bfq_get_queue+0x138/0xfa0 bfq_get_bfqq_handle_split+0xe3/0x2c0 bfq_init_rq+0x196/0xbb0 bfq_insert_request.isra.0+0xb5/0x480 bfq_insert_requests+0x156/0x180 blk_mq_insert_request+0x15d/0x440 blk_mq_submit_bio+0x8a4/0xb00 submit_bio_noacct_nocheck+0x331/0x400 __blkdev_direct_IO_async+0x2dd/0x330 blkdev_write_iter+0x39a/0x450 io_write+0x22a/0x840 io_issue_sqe+0x87/0x300 io_wq_submit_work+0xeb/0x390 io_worker_handle_work+0x24d/0x550 io_wq_worker+0x27f/0x6c0 ret_from_fork+0x2d/0x50 ret_from_fork_asm+0x1b/0x30 Freed by task 808589: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x27/0x40 __kasan_slab_free+0x126/0x1b0 kmem_cache_free+0x10c/0x750 bfq_put_queue+0x2dd/0x770 __bfq_insert_request.isra.0+0x155/0x7a0 bfq_insert_request.isra.0+0x122/0x480 bfq_insert_requests+0x156/0x180 blk_mq_dispatch_plug_list+0x528/0x7e0 blk_mq_flush_plug_list.part.0+0xe5/0x590 __blk_flush_plug+0x3b/0x90 blk_finish_plug+0x40/0x60 do_writepages+0x19d/0x310 filemap_fdatawrite_wbc+0x95/0xc0 __filemap_fdatawrite_range+0x99/0xd0 filemap_write_and_wait_range.part.0+0x4d/0xa0 blkdev_read_iter+0xef/0x1e0 io_read+0x1b6/0x8a0 io_issue_sqe+0x87/0x300 io_wq_submit_work+0xeb/0x390 io_worker_handle_work+0x24d/0x550 io_wq_worker+0x27f/0x6c0 ret_from_fork+0x2d/0x50 ret_from_fork_asm+0x1b/0x30 Fix the problem by protecting bic_to_bfqq() with bfqd->lock.

Metrics

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score: 7.8 HIGH

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ADP: CISA-ADP

Base Score: 7.8 HIGH

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0 Severity and Vector Strings:

National Institute of Standards and Technology

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

URL	Source(s)	Tag(s)
https://cert-portal.siemens.com/productcert/html/ssa-082556.html	siemens-SADP
https://git.kernel.org/stable/c/01a853faaeaf3379ccf358ade582b1d28752126e	kernel.org	Patch
https://git.kernel.org/stable/c/906cdbdd3b018ff69cc830173bce277a847d4fdc	kernel.org	Patch
https://git.kernel.org/stable/c/ada4ca5fd5a9d5212f28164d49a4885951c979c9	kernel.org
https://git.kernel.org/stable/c/dcaa738afde55085ac6056252e319479cf23cde2	kernel.org	Patch
https://git.kernel.org/stable/c/e8b8344de3980709080d86c157d24e7de07d70ad	kernel.org	Patch
https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html	CVE

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-416	Use After Free	NIST CISA-ADP

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

9 change records found show changes

CVE Modified by kernel.org 6/17/2026 4:08:28 AM

Action

Type

Old Value

New Value

Added

Affected

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["block/bfq-iosched.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"76f1df88bbc2f984eb0418cc90de0a8384e63604","lessThan":"ada4ca5fd5a9d5212f28164d49a4885951c979c9","versionType":"git","status":"affected"},{"version":"76f1df88bbc2f984eb0418cc90de0a8384e63604","lessThan":"906cdbdd3b018ff69cc830173bce277a847d4fdc","versionType":"git","status":"affected"},{"version":"76f1df88bbc2f984eb0418cc90de0a8384e63604","lessThan":"dcaa738afde55085ac6056252e319479cf23cde2","versionType":"git","status":"affected"},{"version":"76f1df88bbc2f984eb0418cc90de0a8384e63604","lessThan":"01a853faaeaf3379ccf358ade582b1d28752126e","versionType":"git","status":"affected"},{"version":"76f1df88bbc2f984eb0418cc90de0a8384e63604","lessThan":"e8b8344de3980709080d86c157d24e7de07d70ad","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["block/bfq-iosched.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.17","status":"affected"},{"version":"0","lessThan":"5.17","versionType":"semver","status":"unaffected"},{"version":"6.1.130","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.64","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.11.11","lessThanOrEqual":"6.11.*","versionType":"semver","status":"unaffected"},{"version":"6.12.2","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.13","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

Initial Analysis by NIST 1/16/2025 11:44:19 AM

Action	Type	Old Value	New Value
Added	CVSS V3.1		NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Added	CWE		NIST CWE-416
Added	CPE Configuration		OR cpe:2.3:o:linux:linux_kernel::::::::* versions from (including) 5.17 up to (excluding) 6.6.64 cpe:2.3:o:linux:linux_kernel::::::::* versions from (including) 6.7 up to (excluding) 6.11.11 cpe:2.3:o:linux:linux_kernel::::::::* versions from (including) 6.12 up to (excluding) 6.12.2
Changed	Reference Type	https://git.kernel.org/stable/c/01a853faaeaf3379ccf358ade582b1d28752126e No Types Assigned	https://git.kernel.org/stable/c/01a853faaeaf3379ccf358ade582b1d28752126e Patch
Changed	Reference Type	https://git.kernel.org/stable/c/906cdbdd3b018ff69cc830173bce277a847d4fdc No Types Assigned	https://git.kernel.org/stable/c/906cdbdd3b018ff69cc830173bce277a847d4fdc Patch
Changed	Reference Type	https://git.kernel.org/stable/c/dcaa738afde55085ac6056252e319479cf23cde2 No Types Assigned	https://git.kernel.org/stable/c/dcaa738afde55085ac6056252e319479cf23cde2 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/e8b8344de3980709080d86c157d24e7de07d70ad No Types Assigned	https://git.kernel.org/stable/c/e8b8344de3980709080d86c157d24e7de07d70ad Patch

New CVE Received from kernel.org 12/27/2024 9:15:23 AM

Action	Type	New Value
Added	Description	Record truncated, showing 2048 of 2945 characters. View Entire Change Record In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix bfqq uaf in bfq_limit_depth() Set new allocated bfqq to bic or remove freed bfqq from bic are both protected by bfqd->lock, however bfq_limit_depth() is deferencing bfqq from bic without the lock, this can lead to UAF if the io_context is shared by multiple tasks. For example, test bfq with io_uring can trigger following UAF in v6.6: ================================================================== BUG: KASAN: slab-use-after-free in bfqq_group+0x15/0x50 Call Trace: <TASK> dump_stack_lvl+0x47/0x80 print_address_description.constprop.0+0x66/0x300 print_report+0x3e/0x70 kasan_report+0xb4/0xf0 bfqq_group+0x15/0x50 bfqq_request_over_limit+0x130/0x9a0 bfq_limit_depth+0x1b5/0x480 __blk_mq_alloc_requests+0x2b5/0xa00 blk_mq_get_new_requests+0x11d/0x1d0 blk_mq_submit_bio+0x286/0xb00 submit_bio_noacct_nocheck+0x331/0x400 __block_write_full_folio+0x3d0/0x640 writepage_cb+0x3b/0xc0 write_cache_pages+0x254/0x6c0 write_cache_pages+0x254/0x6c0 do_writepages+0x192/0x310 filemap_fdatawrite_wbc+0x95/0xc0 __filemap_fdatawrite_range+0x99/0xd0 filemap_write_and_wait_range.part.0+0x4d/0xa0 blkdev_read_iter+0xef/0x1e0 io_read+0x1b6/0x8a0 io_issue_sqe+0x87/0x300 io_wq_submit_work+0xeb/0x390 io_worker_handle_work+0x24d/0x550 io_wq_worker+0x27f/0x6c0 ret_from_fork_asm+0x1b/0x30 </TASK> Allocated by task 808602: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_slab_alloc+0x83/0x90 kmem_cache_alloc_node+0x1b1/0x6d0 bfq_get_queue+0x138/0xfa0 bfq_get_bfqq_handle_split+0xe3/0x2c0 bfq_init_rq+0x196/0xbb0 bfq_insert_request.isra.0+0xb5/0x480 bfq_insert_requests+0x156/0x180 blk_mq_insert_request+0x15d/0x440 blk_mq_submit_bio+0x8a4/0xb00 submit_bio_noacct_nocheck+0x331/0x400 __blkdev_direct_IO_async+0x2dd/0x330 blkdev_write_iter+0x39a/0x450 io_write+0x22a/0x840 io_issue_sqe+0x87/0x300 io_wq_submit_work+0xeb/0x390 io_worker_handle_work+0x24d/0x550 io_wq_worker+0x27f/0x6c0 ret_from_fork+0x2d/0x50 ret_
Added	Reference	https://git.kernel.org/stable/c/01a853faaeaf3379ccf358ade582b1d28752126e
Added	Reference	https://git.kernel.org/stable/c/906cdbdd3b018ff69cc830173bce277a847d4fdc
Added	Reference	https://git.kernel.org/stable/c/dcaa738afde55085ac6056252e319479cf23cde2
Added	Reference	https://git.kernel.org/stable/c/e8b8344de3980709080d86c157d24e7de07d70ad

Quick Info

CVE Dictionary Entry:
CVE-2024-53166
NVD Published Date:
12/27/2024
NVD Last Modified:
06/17/2026
Source:
kernel.org

You are viewing this page in an unauthorized frame window.

Information Technology Laboratory

National Vulnerability Database

National Vulnerability Database

CVE-2024-53166 Detail

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Change History

CVE Modified by siemens-SADP 6/17/2026 4:08:28 AM

CVE Modified by CISA-ADP 6/17/2026 4:08:28 AM

CVE Modified by kernel.org 6/17/2026 4:08:28 AM

CVE Modified by siemens-SADP 5/12/2026 9:16:22 AM

CVE Modified by CVE 11/03/2025 3:16:39 PM

CVE Modified by kernel.org 3/07/2025 1:15:43 PM

CVE Modified by CISA-ADP 2/10/2025 1:15:26 PM

Initial Analysis by NIST 1/16/2025 11:44:19 AM

New CVE Received from kernel.org 12/27/2024 9:15:23 AM

Quick Info