{"id":"CVE-2024-50127","revision":"b40ccc2f4e0f4b198239b8af899e074f","records":[{"revision":"b40ccc2f4e0f4b198239b8af899e074f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-50127","aliases":[],"title":"net: sched: fix use-after-free in taprio_change()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: fix use-after-free in taprio_change()\n\nIn 'taprio_change()', 'admin' pointer may become dangling due to sched\nswitch / removal caused by 'advance_sched()', and critical section\nprotected by 'q->current_entry_lock' is too small to prevent from such\na scenario (which causes use-after-free detected by KASAN). Fix this\nby prefer 'rcu_replace_pointer()' over 'rcu_assign_pointer()' to update\n'admin' immediately before an attempt to schedule freeing.","state":0,"publishedAt":"2024-11-05T17:10:54.385+00:00","modifiedAt":"2026-10-15T00:57:08.737+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/sched/sch_taprio.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"a3d43c0d56f1b94e74963a2fbadfb70126d92213\",\n                            \"lessThan\": \"2f868ce6013548a713c431c679ef73747a66fcf3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a3d43c0d56f1b94e74963a2fbadfb70126d92213\",\n                            \"lessThan\": \"8a283a19026aaae8a773fd8061263cfa315b127f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a3d43c0d56f1b94e74963a2fbadfb70126d92213\",\n                            \"lessThan\": \"999612996df28d81f163dad530d7f8026e03aec6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a3d43c0d56f1b94e74963a2fbadfb70126d92213\",\n                            \"lessThan\": \"fe371f084073e8672a2d7d46b335c3c060d1e301\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a3d43c0d56f1b94e74963a2fbadfb70126d92213\",\n                            \"lessThan\": \"0d4c0d2844e4eac3aed647f948fd7e60eea56a61\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a3d43c0d56f1b94e74963a2fbadfb70126d92213\",\n                            \"lessThan\": \"2240f9376f20f8b6463232b4ca7292569217237f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a3d43c0d56f1b94e74963a2fbadfb70126d92213\",\n                            \"lessThan\": \"f504465970aebb2467da548f7c1efbbf36d0f44b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/sched/sch_taprio.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.2\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.285\",\n                            \"lessThanOrEqual\": \"5.4.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.229\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.170\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.115\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.59\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.11.6\",\n                            \"lessThanOrEqual\": \"6.11.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/2f868ce6013548a713c431c679ef73747a66fcf3","https://git.kernel.org/stable/c/8a283a19026aaae8a773fd8061263cfa315b127f","https://git.kernel.org/stable/c/999612996df28d81f163dad530d7f8026e03aec6","https://git.kernel.org/stable/c/fe371f084073e8672a2d7d46b335c3c060d1e301","https://git.kernel.org/stable/c/0d4c0d2844e4eac3aed647f948fd7e60eea56a61","https://git.kernel.org/stable/c/2240f9376f20f8b6463232b4ca7292569217237f","https://git.kernel.org/stable/c/f504465970aebb2467da548f7c1efbbf36d0f44b"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-50127","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-50127","identifiers":["CVE-2024-50127"]},"retained":false,"historicalAffected":[]}],"coverage":[]}