Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s BFQ disk scheduler can make the kernel access memory after it has been freed. A low-privileged local user could potentially cause a crash, expose data, or alter system behavior. The supplied evidence does not establish a practical exploit or active attacks.
Executive priority
Treat this as an accelerated kernel-patching priority, especially on shared or multi-user Linux systems. It is not supported as an unauthenticated internet emergency: exploitation requires local privileges, and no active exploitation is documented in the supplied sources. Require asset-level confirmation because distribution backports complicate version assessment.
Technical view
During BFQ queue splitting, bfq_split_bfqq() can free the queue when the current process is its last holder. A later waker_bfqq access can then cause use-after-free. Retaining the waker pointer is also unsafe when it belongs to the merge chain. The referenced fix adds validation through bfq_waker_bfqq().
Likely exposure
Exposure is limited to Linux kernels containing the affected BFQ code and reaching the vulnerable scheduling path. Internet reachability alone does not enable exploitation because the CVSS vector requires local, low-privileged access. Exact exposure requires mapping the running distribution kernel or backport to the listed affected identifiers and referenced fixes.
Exploitation context
No cited source substantiates active exploitation, and the supplied KEV flag is false. The CVSS vector indicates local access, low privileges, low complexity, and no user interaction. The sources do not establish exploit reliability, observed indicators, or additional environmental prerequisites.
Researcher notes
The critical lifetime condition occurs when the current process is the final bfqq holder during splitting. waker_bfqq may itself be within the queue’s merge chain, so preserving only that pointer does not eliminate the unsafe reference. The supplied material provides no proof-of-concept, exploitation telemetry, or definitive distribution-by-distribution version matrix.
Mitigation direction
- Apply a distribution-supported kernel update incorporating the referenced stable fix for CVE-2024-49854.
- Reboot affected hosts into the updated kernel and verify that the running version changed.
- For unsupported kernels, check vendor guidance and backport status before treating the issue as resolved.
- Prioritize multi-user systems where untrusted local users can execute code.
Validation and detection
- Inventory running kernel versions and map vendor builds to the bundle’s listed affected identifiers.
- Determine whether the BFQ I/O scheduler is present and used on relevant block devices.
- Confirm the running kernel includes an applicable referenced fix or vendor-equivalent backport.
- Review distribution advisories because package version strings may not clearly reveal backported fixes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-49854 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/63a07379fdb6c72450cb05294461c6016b8b7726CVE reference, Linux
- https://git.kernel.org/stable/c/de0456460f2abf921e356ed2bd8da87a376680bdCVE reference, Linux
- https://git.kernel.org/stable/c/0780451f03bf518bc032a7c584de8f92e2d39d7fCVE reference, Linux
- https://git.kernel.org/stable/c/0b8bda0ff17156cd3f60944527c9d8c9f99f1583CVE reference, Linux
- https://git.kernel.org/stable/c/cae58d19121a70329cf971359e2518c93fec04feCVE reference, Linux
- https://git.kernel.org/stable/c/1ba0403ac6447f2d63914fb760c44a3b19c44eafCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.