CVE-2024-50127

What it actually does

Use-after-free in Linux kernel taprio qdisc when 'admin' pointer becomes dangling after sched switch/removal by advance_sched(), with insufficient protection from q->current_entry_lock, allowing KASAN-detected invalid access.

Why it matters to the business

Linux systems using network traffic scheduling may experience kernel crashes, memory corruption, or local privilege escalation, disrupting network operations and requiring urgent kernel updates across server fleets.

How an attack unfolds

A local attacker loads or modifies taprio qdisc configuration to trigger concurrent sched operations that free the admin pointer, then accesses the freed memory within the narrow critical section before the RCU-protected update, leading to arbitrary kernel code execution or denial of service.

How to fix it

Upgrade the Linux kernel to a version containing commit 2f868ce6013548a713c431c679ef73747a66fcf3 or later; rebuild and reboot affected systems with the patched kernel.

How to confirm the fix worked

Verify the running kernel includes commit 2f868ce6013548a713c431c679ef73747a66fcf3 via git log or kernel version check; test taprio qdisc configuration changes under load to confirm absence of KASAN reports or crashes.

Typical attack path

1. Obtain local user access on a Linux system
2. Configure or change taprio qdisc settings to invoke taprio_change()
3. Trigger concurrent sched switch or removal via advance_sched()
4. Exploit the window where admin pointer is dangling before rcu_replace_pointer update
5. Perform use-after-free operations to corrupt kernel memory or execute code

How to detect it

Review kernel logs for KASAN use-after-free reports involving taprio_change or admin pointer; inspect audit logs for unusual taprio qdisc configuration changes by non-privileged users.

What your security team should do

• Prioritize kernel upgrades on all systems using taprio or advanced network scheduling
• Monitor for local privilege escalation attempts on Linux hosts
• Apply patches within standard change windows given low EPSS and non-KEV status
• Review network qdisc configurations to minimize taprio usage where possible