Vulnerability Intelligence Report
Kernel: use-after-free after removing device in wb_inode_writeback_end in mm/page-writeback.c
CVE-2024-0562
A use-after-free flaw was found in the Linux Kernel. When a disk is removed, bdi_unregister is called to stop further write-back and waits for associated delayed work to complete. However, wb_inode_writeback_end() may schedule bandwidth estimation work after this has completed, which can result in the timer attempting to access the recently freed bdi_writeback.
No Active Exploit Signals
CVSS Base Score
7.8
HIGH
Exploitability:1.9
Impact Score:5.9
EPSS Probability:0.25%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-416 ↗Use After Free
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| 0 < 6.0-rc3 (affected) | ||
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support | 0:4.18.0-372.87.1.el8_6 < * (unaffected) |
| Red Hat | Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 | 0:4.18.0-372.87.1.el8_6 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 6 | all |
| Red Hat | Red Hat Enterprise Linux 7 | all |
| Red Hat | Red Hat Enterprise Linux 7 | all |
| Red Hat | Red Hat Enterprise Linux 8 | all |
| Red Hat | Red Hat Enterprise Linux 8 | all |
| Red Hat | Red Hat Enterprise Linux 9 | all |
| Red Hat | Red Hat Enterprise Linux 9 | all |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.254%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Red Hat, Inc. · Vendor · USA |
| Reserved | 2024-01-15T15:02:03 |
| Published | 2024-01-15T19:01:36 |
| Patch Date | 2023-03-10 |
| Last Updated | 2025-11-15T08:17:20 |
Community Chatter & Buzz