CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's block multi-queue (blk-mq) subsystem, where a use-after-free condition can occur when cached requests are improperly managed during blocking operations. This flaw could lead to potential system instability or exploitation, making it critical for organizations using Linux-based systems, particularly those relying on high-performance storage solutions, to prioritize patching. System administrators and security teams should address this issue promptly to mitigate risks associated with this high-severity vulnerability.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blk_mq_free_plug_rqs, freeing the cached_rqs. This creates a use-after-free bug. Fix this by popping the cached request before any possible blocking calls if it is suitable for use. Popping this request first holds a queue reference, so avoid any serialization races with queue freezes and can safely proceed with dispatching that request to the driver. This potentially increases a timing window from when a driver wants to freeze its queue to when requests stop being dispatched. That scenario is off the fast path though, and drivers need to appropriately handle requests during a freeze request anyway. The downside is the popped element needs to be individually freed when we performed a bio plug merge. The cached request would have had to be freed later anyway, but this patch does it inline with building the plug list instead of after flushing it.