CVE-2024-50126

A use-after-free vulnerability was found in the taprio_dump() function in the Linux kernel.

A use-after-free vulnerability was found in the Linux kernel's traffic control (tc) subsystem in the taprio_dump() function of the TAPRIO qdisc. When a TAPRIO qdisc was dumped or replaced through rtnetlink, taprio_dump() could read scheduling data that had already been freed because it was not executed inside an RCU read-side critical section. Exploiting this flaw requires local access and the ability to configure traffic-control qdiscs; the issue was detected with KASAN on an arm64 system. Red Hat Product Security has rated this flaw as Moderate impact. Although the CVSS 3.1 base score of 7.8 reflects the theoretical maximum impact of a local use-after-free, practical exploitation is limited by the need for local privileged access, and the observed manifestation is a small read of already-freed memory rather than demonstrated arbitrary code execution. Red Hat Enterprise Linux 9 is affected, and a fix is being pursued through the delegated kernel process for RHEL 9.6, while the RHEL 9.5.z maintenance stream has been marked as won't fix for this issue. Red Hat Enterprise Linux 6, 7, and 8, as well as Red Hat's hosted OpenShift offerings (ARO and OSD), are not affected. Fedora is affected, with its resolution handled by the community.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.