High 7.8Published Dec 27, 2024

CVE-2024-56672blk-cgroup: Fix UAF in blkcg_unpin_online()

Updated under an hour ago (2026-10-19 07:23 UTC)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix UAF in blkcg_unpin_online() blkcg_unpin_online() walks up the blkcg hierarchy putting the online pin. To walk up, it uses blkcg_parent(blkcg) but it was calling that after blkcg_destroy_blkgs(blkcg) which could free the blkcg, leading to the following UAF: ================================================================== BUG: KASAN: slab-use-after-free in blkcg_unpin_online+0x15a/0x270 Read of size 8 at addr ffff8881057678c0 by task kworker/9:1/117 CPU: 9 UID: 0 PID: 117 Comm: kworker/9:1 Not tainted 6.13.0-rc1-work-00182-gb8f52214c61a-dirty #48 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022 Workqueue: cgwb_release cgwb_release_workfn Call Trace: <TASK> dump_stack_lvl+0x27/0x80 print_report+0x151/0x710 kasan_report+0xc0/0x100 blkcg_unpin_online+0x15a/0x270 cgwb_release_workfn+0x194/0x480 process_scheduled_works+0x71b/0xe20 worker_thread+0x82a/0xbd0 kthread+0x242/0x2c0 ret_from_fork+0x33/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> ... Freed by task 1944: kasan_save_track+0x2b/0x70 kasan_save_free_info+0x3c/0x50 __kasan_slab_free+0x33/0x50 kfree+0x10c/0x330 css_free_rwork_fn+0xe6/0xb30 process_scheduled_works+0x71b/0xe20 worker_thread+0x82a/0xbd0 kthread+0x242/0x2c0 ret_from_fork+0x33/0x70 ret_from_fork_asm+0x1a/0x30 Note that the UAF is not easy to trigger as the free path is indirected behind a couple RCU grace periods and a work item execution. I could only trigger it with artifical msleep() injected in blkcg_unpin_online(). Fix it by reading the parent pointer before destroying the blkcg's blkg's.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-416
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	4308a434e5e08c78676aa66bc626ef78cbef0883 builds before 83f5a87ee8caa76a917f59912a74d6811f773c67; 4308a434e5e08c78676aa66bc626ef78cbef0883 builds before 8a07350fe070017a887433f4d6909433955be5f1; 4308a434e5e08c78676aa66bc626ef78cbef0883 builds before 64afc6fe24c9896c0153e5a199bcea241ecb0d5c; 4308a434e5e08c78676aa66bc626ef78cbef0883 builds before 5baa28569c924d9a90d036c2aaab79f791fedaf8; 4308a434e5e08c78676aa66bc626ef78cbef0883 builds before 29d1e06560f0f6179062ac638b4064deb637d1ad; 4308a434e5e08c78676aa66bc626ef78cbef0883 builds before 86e6ca55b83c575ab0f2e105cf08f98e58d3d7af	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	before V1.1.1	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.7 before 6.1.121; from 6.2 before 6.6.67; from 6.7 before 6.12.6; 6.13; 6.13	NVD

References

https://git.kernel.org/stable/c/83f5a87ee8caa76a917f59912a74d6811f773c67
https://git.kernel.org/stable/c/8a07350fe070017a887433f4d6909433955be5f1
https://git.kernel.org/stable/c/64afc6fe24c9896c0153e5a199bcea241ecb0d5cpatch
https://git.kernel.org/stable/c/5baa28569c924d9a90d036c2aaab79f791fedaf8patch
https://git.kernel.org/stable/c/29d1e06560f0f6179062ac638b4064deb637d1adpatch
https://git.kernel.org/stable/c/86e6ca55b83c575ab0f2e105cf08f98e58d3d7afpatch
https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
https://cert-portal.siemens.com/productcert/html/ssa-265688.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.