Linux Kernel Loop Device Use-After-Free Vulnerability

A use-after-free vulnerability has been identified in the Linux kernel's loop device implementation. The issue arises in the 'loop_handle_cmd()' function, which improperly dereferences command and request pointers after the 'do_req_filebacked()' function has completed processing. This flaw can lead to a kernel crash due to a null pointer dereference. The vulnerability occurs because 'do_req_filebacked()' calls 'blk_mq_complete_request()' either synchronously or asynchronously, depending on the I/O method used, unless memory allocation fails.

Impact

Exploitation of this vulnerability causes a kernel crash by dereferencing a null pointer, leading to a denial of service condition.