CVE-2024-49854

What it actually does

Use-after-free when accessing waker_bfqq after bfq_split_bfqq frees the last reference to a bfqq that may be part of a merge chain.

Why it matters to the business

Kernel memory corruption on systems using the BFQ I/O scheduler can lead to crashes, data corruption, or local privilege escalation; high downstream prevalence increases exposure across Linux distributions.

How an attack unfolds

An attacker triggers BFQ queue splitting under specific I/O patterns that cause the current process to be the final holder of the bfqq, then re-accesses the freed waker_bfqq pointer either directly or through the merge chain, resulting in a use-after-free that can be turned into arbitrary read/write or control-flow hijacking. Named threat actors have leveraged similar Linux kernel UAF primitives in 2024 campaigns.

How to fix it

Upgrade the Linux kernel to a version containing the bfq_waker_bfqq helper that validates the merge chain and holder count before access. For the listed affected package, update nokogiri (RubyGems) to version 1.8.1.

How to confirm the fix worked

Confirm the patch by inspecting the bfq_split_bfqq path for the new bfq_waker_bfqq helper; run targeted BFQ queue-split stress tests and verify no UAF reports under KASAN or similar sanitizers.

Typical attack path

1. Craft I/O workload that forces bfq_split_bfqq on a bfqq with a waker_bfqq in its merge chain
2. Ensure the attacking process is the last reference holder so the bfqq is freed
3. Immediately dereference the recorded waker_bfqq pointer before reclamation
4. Leverage the resulting UAF for kernel memory corruption or ROP
5. Escalate to root or install persistence

How to detect it

Search kernel logs for BFQ-related use-after-free reports, KASAN splats mentioning waker_bfqq or bfq_split_bfqq, and unexpected process crashes during heavy I/O; correlate with threat-actor TTPs observed in 2024 zero-day campaigns.

• bfq_split_bfqq
• waker_bfqq
• KASAN: use-after-free in bfq
• bfq_waker_bfqq

What your security team should do

• Apply the kernel fix immediately on all systems using the BFQ scheduler
• Prioritize hosts with high EPSS exposure and any listed threat-actor activity
• Update nokogiri (RubyGems) to 1.8.1 across all Ruby environments
• Monitor for new kernel releases containing the referenced commit
• Reboot after kernel updates to load the patched module