{"id":"CVE-2024-0562","title":"Kernel: use-after-free after removing device in wb_inode_writeback_end in mm/page-writeback.c","summary":"A use-after-free flaw was found in the Linux Kernel. When a disk is removed, bdi_unregister is called to stop further write-back and waits for associated delayed work to complete. However, wb_inode_writeback_end() may schedule bandwidth …","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-416"],"vendor":"Red Hat","product":"kernel","affected":["kernel < 6.0-rc3","kernel (all versions)","kernel (all versions)","kernel","kernel","kernel-rt","kernel (all versions)","kernel-rt","kernel","kernel-rt"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2024-01-16T15:31:12.238360Z"},"published":"2024-01-15","updated":"2026-11-05","sourceUpdated":"2026-11-05T11:39:07.790Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-0562","references":[{"url":"https://access.redhat.com/errata/RHSA-2024:0412","label":"RHSA-2024:0412"},{"url":"https://access.redhat.com/security/cve/CVE-2024-0562"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2258475","label":"RHBZ#2258475"},{"url":"https://patchwork.kernel.org/project/linux-mm/patch/20220801155034.3772543-1-khazhy@google.com/"}],"tags":["cve.org"],"epss":0.00254,"epssPercentile":0.17151,"ingestedAt":"2026-11-05T21:36:00.817Z","slug":"CVE-2024-0562","body":"## Overview\n\nA use-after-free flaw was found in the Linux Kernel. When a disk is removed, bdi_unregister is called to stop further write-back and waits for associated delayed work to complete. However, wb_inode_writeback_end() may schedule bandwidth estimation work after this has completed, which can result in the timer attempting to access the recently freed bdi_writeback.\n\n## Affected\n\n- `kernel < 6.0-rc3`\n- `kernel (all versions)`\n- `kernel (all versions)`\n- `kernel`\n- `kernel`\n- `kernel-rt`\n- `kernel (all versions)`\n- `kernel-rt`\n- `kernel`\n- `kernel-rt`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nMitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}