CVE-2024-50127

In the Linux kernel, the following vulnerability has been resolved:

net: sched: fix use-after-free in taprio_change()

In 'taprio_change()', 'admin' pointer may become dangling due to sched switch / removal caused by 'advance_sched()', and critical section protected by 'q->current_entry_lock' is too small to prevent from such a scenario (which causes use-after-free detected by KASAN). Fix this by prefer 'rcu_replace_pointer()' over 'rcu_assign_pointer()' to update 'admin' immediately before an attempt to schedule freeing.

The config param CONFIG_NET_SCH_TAPRIO enabled only for latest versions of Red Hat Enterprise Linux 9 (as a module). Issue could happen only for specific usage of taprio (for example tc qdisc taprio) and only if debug enabled (with KASAN). The potential attack complexity is high. Will be fixed in affected versions of Red Hat Enterprise Linux.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module sch_taprio from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.