Executive brief
The Linux kernel's BFQ (Budget Fair Queueing) I/O scheduler contains a use-after-free vulnerability in queue management when processes move between cgroups. An attacker with local access could trigger memory corruption and potentially gain code execution, affecting system stability and security across any Linux system using the BFQ scheduler.
Technical details
The vulnerability exists in the block/bfq scheduler's handling of queue references ('bfqq->bic') when processes are moved between cgroups. The root cause stems from commit 3bc5e683c67d which can result in both an old and new queue pointing to the same I/O context (BIC), with no guarantee of proper cleanup order. When the I/O context is freed before all associated queues, a use-after-free condition occurs. The attack vector requires local access and involves moving a process to a different cgroup while I/O operations are in flight. The fix clears the queue's BIC pointer during queue detachment to prevent dangling references and ensure safe cleanup ordering.
Affected products
- Linux Linux Kernel 5.10 and other affected versions
Timeline
- 2025-10-04: disclosed