CVE-2024-50127

HighCVSS 7.8/10Last modified Oct 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: sched: fix use-after-free in taprio_change()

In 'taprio_change()', 'admin' pointer may become dangling due to sched switch / removal caused by 'advance_sched()', and critical section protected by 'q->current_entry_lock' is too small to prevent from such a scenario (which causes use-after-free detected by KASAN). Fix this by prefer 'rcu_replace_pointer()' over 'rcu_assign_pointer()' to update 'admin' immediately before an attempt to schedule freeing.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
LinuxLinux>= a3d43c0d56f1b94e74963a2fbadfb70126d92213, < 2f868ce6013548a713c431c679ef73747a66fcf3; >= a3d43c0d56f1b94e74963a2fbadfb70126d92213, < 8a283a19026aaae8a773fd8061263cfa315b127f; >= a3d43c0d56f1b94e74963a2fbadfb70126d92213, < 999612996df28d81f163dad530d7f8026e03aec6; >= a3d43c0d56f1b94e74963a2fbadfb70126d92213, < fe371f084073e8672a2d7d46b335c3c060d1e301; >= a3d43c0d56f1b94e74963a2fbadfb70126d92213, < 0d4c0d2844e4eac3aed647f948fd7e60eea56a61; >= a3d43c0d56f1b94e74963a2fbadfb70126d92213, < 2240f9376f20f8b6463232b4ca7292569217237f; >= a3d43c0d56f1b94e74963a2fbadfb70126d92213, < f504465970aebb2467da548f7c1efbbf36d0f44b
LinuxLinux5.2
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystem< V1.1.1

References

Timeline

Published
Nov 5, 2024
Last modified
Oct 15, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-501287.1In the Linux kernel, the following vulnerability has been resolved: net: wwan: fix global oob in wwan_rtnl_policy The variable wwan_rtnl_lCVE-2024-501297.8In the Linux kernel, the following vulnerability has been resolved: net: pse-pd: Fix out of bound for loop Adjust the loop limit to prevenCVE-2024-50137.5In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Denial of Service vulnerability was identified. An unauthenticated aCVE-2024-501307.8In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: must hold reference on net namespace BUG: KASAN: slab-CVE-2024-501317.8In the Linux kernel, the following vulnerability has been resolved: tracing: Consider the NULL character when validating the event length CVE-2024-501325.5In the Linux kernel, the following vulnerability has been resolved: tracing/probes: Fix MAX_TRACE_ARGS limit handling When creating a tracCVE-2024-501335.5In the Linux kernel, the following vulnerability has been resolved: LoongArch: Don't crash in stack_top() for tasks without vDSO Not all tCVE-2024-501345.5In the Linux kernel, the following vulnerability has been resolved: drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape withCVE-2024-501354.7In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix race condition between reset and nvme_dev_disable() nvmeCVE-2024-501365.5In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Unregister notifier on eswitch init failure It otherwise remCVE-2024-501375.5In the Linux kernel, the following vulnerability has been resolved: reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC CVE-2024-501385.5In the Linux kernel, the following vulnerability has been resolved: bpf: Use raw_spinlock_t in ringbuf The function __bpf_ringbuf_reserve
CVE-2024-50127: High severity, CVSS 7.8 | Vulnix