Linux Kernel BFQ I/O Scheduler Cgroup Information Update Vulnerability

A vulnerability in the Linux kernel's BFQ (Budget Fair Queueing) I/O scheduler has been addressed. The issue arose when processes were migrated to different cgroups, leading to the potential for stale cgroup information to be used in the bio merging process. This could result in bios being incorrectly merged across different cgroups or cause merging of bfqqs (BFQ queues) from already terminated cgroups, potentially leading to use-after-free vulnerabilities. The issue has been fixed by ensuring that cgroup information is updated before merging bios.

Impact

Exploitation of this vulnerability could lead to use-after-free issues, which may be exploited to cause memory corruption.