In the Linux kernel, the following vulnerability has been resolved:
block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()
Our syzkaller report a following UAF for v6.6:
BUG: KASAN: slab-use-after-free in bfq_init_rq+0x175d/0x17a0 block/bfq-iosched.c:6958 Read of size 8 at addr ffff8881b57147d8 by task fsstress/232726
CPU: 2 PID: 232726 Comm: fsstress Not tainted 6.6.0-g3629d1885222 #39 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x91/0xf0 lib/dump_stack.c:106 print_address_description.constprop.0+0x66/0x300 mm/kasan/report.c:364 print_report+0x3e/0x70 mm/kasan/report.c:475 kasan_report+0xb8/0xf0 mm/kasan/report.c:588 hlist_add_head include/linux/list.h:1023 [inline] bfq_init_rq+0x175d/0x17a0 block/bfq-iosched.c:6958 bfq_insert_request.isra.0+0xe8/0xa20 block/bfq-iosched.c:6271 bfq_insert_requests+0x27f/0x390 block/bfq-iosched.c:6323 blk_mq_insert_request+0x290/0x8f0 block/blk-mq.c:2660 blk_mq_submit_bio+0x1021/0x15e0 block/blk-mq.c:3143 __submit_bio+0xa0/0x6b0 block/blk-core.c:639 __submit_bio_noacct_mq block/blk-core.c:718 [inline] submit_bio_noacct_nocheck+0x5b7/0x810 block/blk-core.c:747 submit_bio_noacct+0xca0/0x1990 block/blk-core.c:847 __ext4_read_bh fs/ext4/super.c:205 [inline] ext4_read_bh+0x15e/0x2e0 fs/ext4/super.c:230 __read_extent_tree_block+0x304/0x6f0 fs/ext4/extents.c:567 ext4_find_extent+0x479/0xd20 fs/ext4/extents.c:947 ext4_ext_map_blocks+0x1a3/0x2680 fs/ext4/extents.c:4182 ext4_map_blocks+0x929/0x15a0 fs/ext4/inode.c:660 ext4_iomap_begin_report+0x298/0x480 fs/ext4/inode.c:3569 iomap_iter+0x3dd/0x1010 fs/iomap/iter.c:91 iomap_fiemap+0x1f4/0x360 fs/iomap/fiemap.c:80 ext4_fiemap+0x181/0x210 fs/ext4/extents.c:5051 ioctl_fiemap.isra.0+0x1b4/0x290 fs/ioctl.c:220 do_vfs_ioctl+0x31c/0x11a0 fs/ioctl.c:811 __do_sys_ioctl fs/ioctl.c:869 [inline] __se_sys_ioctl+0xae/0x190 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x70/0x120 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x78/0xe2
Allocated by task 232719: kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 __kasan_slab_alloc+0x87/0x90 mm/kasan/common.c:328 kasan_slab_alloc include/linux/kasan.h:188 [inline] slab_post_alloc_hook mm/slab.h:768 [inline] slab_alloc_node mm/slub.c:3492 [inline] kmem_cache_alloc_node+0x1b8/0x6f0 mm/slub.c:3537 bfq_get_queue+0x215/0x1f00 block/bfq-iosched.c:5869 bfq_get_bfqq_handle_split+0x167/0x5f0 block/bfq-iosched.c:6776 bfq_init_rq+0x13a4/0x17a0 block/bfq-iosched.c:6938 bfq_insert_request.isra.0+0xe8/0xa20 block/bfq-iosched.c:6271 bfq_insert_requests+0x27f/0x390 block/bfq-iosched.c:6323 blk_mq_insert_request+0x290/0x8f0 block/blk-mq.c:2660 blk_mq_submit_bio+0x1021/0x15e0 block/blk-mq.c:3143 __submit_bio+0xa0/0x6b0 block/blk-core.c:639 __submit_bio_noacct_mq block/blk-core.c:718 [inline] submit_bio_noacct_nocheck+0x5b7/0x810 block/blk-core.c:747 submit_bio_noacct+0xca0/0x1990 block/blk-core.c:847 __ext4_read_bh fs/ext4/super.c:205 [inline] ext4_read_bh_nowait+0x15a/0x240 fs/ext4/super.c:217 ext4_read_bh_lock+0xac/0xd0 fs/ext4/super.c:242 ext4_bread_batch+0x268/0x500 fs/ext4/inode.c:958 __ext4_find_entry+0x448/0x10f0 fs/ext4/namei.c:1671 ext4_lookup_entry fs/ext4/namei.c:1774 [inline] ext4_lookup.part.0+0x359/0x6f0 fs/ext4/namei.c:1842 ext4_lookup+0x72/0x90 fs/ext4/namei.c:1839 __lookup_slow+0x257/0x480 fs/namei.c:1696 lookup_slow fs/namei.c:1713 [inline] walk_component+0x454/0x5c0 fs/namei.c:2004 link_path_walk.part.0+0x773/0xda0 fs/namei.c:2331 link_path_walk fs/namei.c:3826 [inline] path_openat+0x1b9/0x520 fs/namei.c:3826 do_filp_open+0x1b7/0x400 fs/namei.c:3857 do_sys_openat2+0x5dc/0x6e0 fs/open.c:1428 do_sys_open fs/open.c:1443 [inline] __do_sys_openat fs/open.c:1459 [inline] __se_sys_openat fs/open.c:1454 [inline] __x64_sys_openat+0x148/0x200 fs/open.c:1454 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_6 ---truncated---
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-coreUpgrade kernel-rt-debug-coreUpgrade kernel-64k-debug-coreUpgrade kernel-rt-modules-extraUpgrade libperfUpgrade kernel-debug-develUpgrade kernel-headersUpgrade rtlaUpgrade kernel-rt-64k-debug-develUpgrade kernelUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-debug-uki-virtUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-rt-64k-modulesUpgrade kernel-develUpgrade kernel-rt-debugUpgrade kernel-64k-modulesUpgrade kernel-zfcpdump-develUpgrade kernel-cross-headersUpgrade kernel-rt-64k-debugUpgrade perfUpgrade kernel-tools-libs-develUpgrade kernel-debugUpgrade kernel-modules-coreUpgrade python3-perfUpgrade kernel-64k-debug-develUpgrade kernel-64k-modules-coreUpgrade kernel-64kUpgrade kernel-rt-64k-modules-extraUpgrade kernel-rt-64k-debug-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-modules-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-zfcpdumpUpgrade kernel-64k-modules-extraUpgrade kernel-rt-64k-develUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-debugUpgrade kernel-64k-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-zfcpdump-devel-matchedUpgrade rvUpgrade kernel-tools-libsUpgrade kernel-uki-virtUpgrade kernel-modules-extraUpgrade kernel-rt-64k-modules-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-64kUpgrade kernel-toolsUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rtUpgrade kernel-rt-64k-coreUpgrade kernel-64k-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-modulesUpgrade kernel-rt-modulesUpgrade kernel-coreUpgrade kernel-abi-stablelistsUpgrade kernel-rt-debug-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-docUpgrade kernel-debug-modulesUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-develUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debug-modules-coreUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-modules-extra | Nov 20, 2025 | Nov 11, 2025 |
| Amazon Linux Ami 2 | — | Upgrade python-perfUpgrade kernel-develUpgrade perf-debuginfoUpgrade bpftool-debuginfoUpgrade bpftoolUpgrade perfUpgrade kernel-toolsUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-develUpgrade python-perf-debuginfoUpgrade kernel-debuginfoUpgrade kernelUpgrade kernel-livepatch-5.15.178-120.178Upgrade kernel-tools-debuginfoUpgrade kernel-headers | Feb 26, 2025 | Jan 19, 2025 |
| Amazon_linux_2023 | — | Upgrade kernel-libbpf-staticUpgrade kernel-livepatch-6.1.124-134.200Upgrade python3-perf-debuginfoUpgrade kernel-headersUpgrade bpftoolUpgrade kernelUpgrade kernel-libbpfUpgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-develUpgrade kernel-modules-extra-commonUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfoUpgrade kernel-develUpgrade perfUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-develUpgrade kernel-livepatch-6.1.127-135.201 | Mar 10, 2025 | Jan 19, 2025 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Feb 10, 2025 | Jan 19, 2025 |
| Oracle_linux | — | Upgrade kernel | Nov 28, 2025 | Jan 19, 2025 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Jul 9, 2025 | Jan 19, 2025 |
| Rocky_linux | — | Upgrade kernel-develUpgrade kernel-rt-develUpgrade kernel-rt-debugUpgrade python3-perfUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-develUpgrade perfUpgrade kernel-debug-uki-virtUpgrade kernel-modules-extraUpgrade kernel-coreUpgrade kernel-debugUpgrade kernel-debuginfoUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-modulesUpgrade kernel-tools-libsUpgrade rtlaUpgrade kernel-debug-coreUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-develUpgrade python3-perf-debuginfoUpgrade kernel-modules-coreUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-develUpgrade kernelUpgrade kernel-rt-modulesUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdumpUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-debug-coreUpgrade rvUpgrade kernel-rtUpgrade kernel-debug-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-debug-devel-matchedUpgrade libperfUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-debuginfoUpgrade kernel-uki-virt-addonsUpgrade kernel-toolsUpgrade kernel-debug-modulesUpgrade kernel-uki-virtUpgrade perf-debuginfoUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-zfcpdump-modules-coreUpgrade libperf-debuginfoUpgrade kernel-zfcpdump-coreUpgrade kernel-debuginfo-common-s390x | Feb 5, 2026 | Nov 21, 2025 |
| Suse | — | Upgrade kernel-debug-vdsoUpgrade kernel-docs-htmlUpgrade kernel-64kb-extraUpgrade dtb-socionextUpgrade dtb-qcomUpgrade dtb-marvellUpgrade dtb-sprdUpgrade kernel-defaultUpgrade kernel-syms-azureUpgrade dtb-amlogicUpgrade kernel-macrosUpgrade kernel-source-vanillaUpgrade gfs2-kmp-azureUpgrade kernel-rtUpgrade kernel-rt-extraUpgrade kernel-azure-optionalUpgrade kernel-kvmsmallUpgrade cluster-md-kmp-64kbUpgrade kernel-azure-develUpgrade kernel-syms-rtUpgrade dtb-nvidiaUpgrade kernel-default-base-rebuildUpgrade kernel-devel-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-obs-buildUpgrade dlm-kmp-64kbUpgrade dtb-appleUpgrade reiserfs-kmp-64kbUpgrade kernel-default-livepatchUpgrade kernel-rt_debugUpgrade kernel-source-rtUpgrade dtb-freescaleUpgrade reiserfs-kmp-rtUpgrade kernel-rt-vdsoUpgrade dtb-rockchipUpgrade dlm-kmp-defaultUpgrade dtb-alteraUpgrade kselftests-kmp-azureUpgrade ocfs2-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade kernel-azureUpgrade kernel-sourceUpgrade kernel-rt_debug-develUpgrade kselftests-kmp-64kbUpgrade dtb-broadcomUpgrade kselftests-kmp-rtUpgrade kernel-azure-extraUpgrade kernel-azure-vdsoUpgrade gfs2-kmp-defaultUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt-optionalUpgrade dlm-kmp-rtUpgrade dtb-lgUpgrade dtb-armUpgrade ocfs2-kmp-defaultUpgrade dlm-kmp-azureUpgrade kernel-64kb-optionalUpgrade kernel-default-extraUpgrade kernel-debug-develUpgrade dtb-caviumUpgrade dtb-mediatekUpgrade reiserfs-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade kernel-64kbUpgrade gfs2-kmp-rtUpgrade dtb-renesasUpgrade dtb-exynosUpgrade kernel-symsUpgrade kernel-rt-develUpgrade kernel-obs-qaUpgrade kernel-default-baseUpgrade dtb-amdUpgrade dtb-allwinnerUpgrade cluster-md-kmp-azureUpgrade reiserfs-kmp-defaultUpgrade kselftests-kmp-defaultUpgrade kernel-develUpgrade kernel-default-livepatch-develUpgrade kernel-default-develUpgrade kernel-zfcpdumpUpgrade cluster-md-kmp-rtUpgrade dtb-xilinxUpgrade dtb-apmUpgrade kernel-64kb-develUpgrade dtb-amazonUpgrade kernel-source-azureUpgrade kernel-default-vdsoUpgrade kernel-default-optionalUpgrade kernel-debugUpgrade ocfs2-kmp-rtUpgrade kernel-kvmsmall-develUpgrade kernel-docsUpgrade gfs2-kmp-64kbUpgrade dtb-hisiliconUpgrade ocfs2-kmp-azureUpgrade kernel-devel-rt | Apr 9, 2025 | Jan 19, 2025 |
| Ubuntu | — | Upgrade linux-image-6.8.0-60-lowlatencyUpgrade linux-image-5.15.0-1079-gcpUpgrade linux-image-nvidia-tegra-igxUpgrade linux-image-5.15.0-1074-nvidiaUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.15.0-135-generic-lpaeUpgrade linux-image-6.11.0-1010-raspiUpgrade linux-image-gcpUpgrade linux-image-gcp-64kUpgrade linux-image-5.15.0-1072-ibmUpgrade linux-image-oem-24.04aUpgrade linux-image-nvidia-6.8Upgrade linux-image-5.15.0-1080-awsUpgrade linux-image-6.8.0-1028-nvidia-lowlatency-64kUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-oracle-64kUpgrade linux-image-5.15.0-1074-raspiUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-aws-lts-24.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-raspiUpgrade linux-image-kvmUpgrade linux-image-gkeUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-realtimeUpgrade linux-image-azure-cvmUpgrade linux-image-nvidia-64kUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-azure-fipsUpgrade linux-image-5.15.0-135-fipsUpgrade linux-image-6.8.0-1030-gcp-64kUpgrade linux-image-6.8.0-1029-azureUpgrade linux-image-6.11.0-1012-azure-fdeUpgrade linux-image-5.15.0-1080-realtimeUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-oem-22.04dUpgrade linux-image-oracleUpgrade linux-image-5.15.0-1080-aws-fipsUpgrade linux-image-6.8.0-60-generic-64kUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-6.11.0-1011-gcp-64kUpgrade linux-image-6.8.0-1030-gcpUpgrade linux-image-5.15.0-1081-gcpUpgrade linux-image-oem-20.04cUpgrade linux-image-6.8.0-1026-oracle-64kUpgrade linux-image-5.15.0-1077-oracleUpgrade linux-image-6.11.0-1013-oracle-64kUpgrade linux-image-6.11.0-1011-gcpUpgrade linux-image-6.8.1-1022-realtimeUpgrade linux-image-oem-20.04Upgrade linux-image-6.8.0-1012-gkeopUpgrade linux-image-6.8.0-1028-nvidia-lowlatencyUpgrade linux-image-raspi-realtimeUpgrade linux-image-awsUpgrade linux-image-6.8.0-60-lowlatency-64kUpgrade linux-image-6.11.0-1011-lowlatencyUpgrade linux-image-5.15.0-1079-gcp-fipsUpgrade linux-image-5.15.0-1077-gkeUpgrade linux-image-5.15.0-1044-xilinx-zynqmpUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.11.0-21-generic-64kUpgrade linux-image-azureUpgrade linux-image-oem-20.04dUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.15.0-1073-intel-iot-realtimeUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-6.8.0-1029-azure-fdeUpgrade linux-image-oem-22.04bUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-azure-lts-24.04Upgrade linux-image-5.15.0-1062-gkeopUpgrade linux-image-gkeop-6.8Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-intelUpgrade linux-image-5.15.0-1083-azure-fipsUpgrade linux-image-6.8.0-60-genericUpgrade linux-image-6.11.0-1017-oemUpgrade linux-image-5.15.0-1074-ibmUpgrade linux-image-oem-22.04Upgrade linux-image-5.15.0-1084-azureUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-5.15.0-1076-kvmUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-gke-5.15Upgrade linux-image-6.11.0-1007-realtimeUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-5.15.0-136-genericUpgrade linux-image-6.11.0-1011-lowlatency-64kUpgrade linux-image-gcp-fipsUpgrade linux-image-5.15.0-135-lowlatency-64kUpgrade linux-image-6.11.0-21-genericUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-ibmUpgrade linux-image-6.8.0-1026-ibmUpgrade linux-image-6.11.0-1012-azureUpgrade linux-image-genericUpgrade linux-image-6.8.0-1028-raspiUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-intel-iotgUpgrade linux-image-raspi-nolpaeUpgrade linux-image-oem-20.04bUpgrade linux-image-nvidia-tegraUpgrade linux-image-oem-24.04Upgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-6.8.0-1028-oemUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.8.0-1025-gkeUpgrade linux-image-6.8.0-1028-nvidia-64kUpgrade linux-image-fipsUpgrade linux-image-generic-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-aws-fipsUpgrade linux-image-5.15.0-1021-nvidia-tegra-igxUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.11.0-1011-awsUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-5.15.0-135-lowlatencyUpgrade linux-image-5.15.0-1074-nvidia-lowlatencyUpgrade linux-image-nvidiaUpgrade linux-image-virtualUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1028-nvidiaUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-5.15.0-1021-nvidia-tegra-igx-rtUpgrade linux-image-azure-nvidiaUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-gkeopUpgrade linux-image-5.15.0-1086-azureUpgrade linux-image-5.15.0-1077-intel-iotgUpgrade linux-image-lowlatencyUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-5.15.0-135-genericUpgrade linux-image-6.8.0-1029-awsUpgrade linux-image-aws-lts-22.04Upgrade linux-image-6.8.0-2023-raspi-realtimeUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-oem-24.04bUpgrade linux-image-azure-lts-22.04Upgrade linux-image-5.15.0-135-generic-64kUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.15.0-1033-nvidia-tegra-rtUpgrade linux-image-oem-22.04aUpgrade linux-image-5.15.0-1086-azure-fdeUpgrade linux-image-6.8.0-1016-azure-nvidiaUpgrade linux-image-5.15.0-1075-intel-iotgUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1026-oracleUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.11.0-1013-oracleUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-5.15.0-136-generic-lpaeUpgrade linux-image-oem-22.04cUpgrade linux-image-5.15.0-1033-nvidia-tegraUpgrade linux-image-5.15.0-136-generic-64k | Mar 28, 2025 | Jan 19, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub