A use-after-free flaw was found in the Linux Kernel. When a disk is removed, bdi_unregister is called to stop further write-back and waits for associated delayed work to complete. However, wb_inode_writeback_end() may schedule bandwidth estimation work after this has completed, which can result in the timer attempting to access the recently freed bdi_writeback.

A use-after-free flaw was found in the Linux Kernel. When a disk is removed, bdi_unregister is called to stop further write-back and waits for associated delayed work to complete. However, wb_inode_writeback_end() may schedule bandwidth estimation work after this has completed, which can result in the timer attempting to access the recently freed bdi_writeback.

kernel: swiotlb information leak with DMA_FROM_DEVICE kernel: uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM kernel: use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges kernel: race condition in xfrm_probe_algs can lead to OOB read/write kernel: race condition in hugetlb_no_page() in mm/hugetlb.c kernel: data races around sk->sk_prot kernel: USB-accessible buffer overflow in brcmfmac kernel: l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference kernel: igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option hw: Intel: Gather Data Sampling (GDS) side channel vulnerability kernel: Report vmalloc UAF in dvb-core/dmxdev kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip kernel: memory corruption in usbmon driver kernel: NULL pointer dereference in traffic control subsystem kernel: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb kernel: NULL pointer dereference in rawv6_push_pending_frames kernel: HID: check empty report_list in hid_validate_values() kernel: hid: Use After Free in asus_remove() kernel: use-after-free in smb2_is_status_io_timeout() kernel: use-after-free caused by invalid pointer hostname in fs/cifs/connect.c kernel: denial of service in tipc_conn_close kernel: Possible use-after-free since the two fdget() during vhost_net_set_backe…

Affected: Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 80 more

A use-after-free flaw was found in the Linux Kernel. When a disk is removed, bdi_unregister is called to stop further write-back and waits for associated delayed work to complete. However, wb_inode_writeback_end() may schedule bandwidth estimation work after this has completed, which can result in the timer attempting to access the recently freed bdi_writeback.

Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen oder einen Denial of Service Zustand herbeizuführen.