Security readout for executives and security teams
Plain-English summary
CVE-2024-53166 is a Linux kernel memory-safety flaw in the BFQ block I/O scheduler. A local user or workload can hit a use-after-free condition, potentially affecting confidentiality, integrity, and availability. The source evidence points to kernel updates as the fix path, not a remote internet-exposed bug.
Executive priority
Treat as a high-priority kernel maintenance issue, especially for shared Linux infrastructure. It is not described as remotely exploitable or actively exploited in the provided sources, but the impact rating is high and local privilege boundaries may matter on multi-tenant systems.
Technical view
The bug is a CWE-416 use-after-free in bfq_limit_depth(). bfq_limit_depth() dereferences a BFQ queue from bic without holding bfqd->lock, while queue assignment and removal are lock-protected. Shared io_context use by multiple tasks, demonstrated with io_uring on Linux 6.6, can trigger the race.
Likely exposure
Exposure is most relevant to Linux systems running affected kernel builds with BFQ block I/O scheduling reachable by local users, containers, or workloads. Exact exposure depends on kernel version, distro backports, and whether BFQ is in use. Debian LTS and Siemens references show downstream tracking, but affected product scope beyond Linux kernel should be vendor-confirmed.
Exploitation context
The CVSS vector is local, low complexity, low privileges, no user interaction, with high confidentiality, integrity, and availability impact. The bundle does not indicate CISA KEV listing or active exploitation. It includes a KASAN crash trace showing a reproducible kernel use-after-free condition, not public weaponized exploitation.
Researcher notes
Focus validation on the BFQ scheduler path, shared io_context behavior, and io_uring-style concurrent I/O. Avoid assuming all Linux systems are exposed. The provided affected-version data is incomplete in flattened form, so rely on kernel stable commits and vendor package advisories for precise build status.
Mitigation direction
- Apply Linux kernel or distro updates containing the referenced stable fixes.
- Use vendor advisories to confirm patched kernel builds and backports.
- Prioritize multi-user, container-host, and shared workload systems using BFQ.
- Track Debian LTS and Siemens guidance where those environments apply.
- If no update is available, request vendor mitigation guidance; no workaround is named.
Validation and detection
- Inventory Linux kernel versions across servers, appliances, and embedded systems.
- Check whether running kernels include one of the referenced stable commits or vendor backports.
- Confirm whether BFQ is enabled or selectable on exposed systems.
- Review local-user and container access on systems pending kernel updates.
- Monitor vendor advisories for corrected package names and fixed release numbers.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-53166 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ada4ca5fd5a9d5212f28164d49a4885951c979c9CVE reference, Linux
- https://git.kernel.org/stable/c/906cdbdd3b018ff69cc830173bce277a847d4fdcCVE reference, Linux
- https://git.kernel.org/stable/c/dcaa738afde55085ac6056252e319479cf23cde2CVE reference, Linux
- https://git.kernel.org/stable/c/01a853faaeaf3379ccf358ade582b1d28752126eCVE reference, Linux
- https://git.kernel.org/stable/c/e8b8344de3980709080d86c157d24e7de07d70adCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.