CVE-2024-50082: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-50082 affects the Linux kernel's block request queue quality of service (blk-rq-qos) subsystem. The vulnerability was discovered in October 2024 and involves a race condition between rq_qos_wait and rq_qos_wake_function that can lead to system crashes. The issue affects Linux kernel versions from 4.19 through 6.11.5 (NVD).

The vulnerability stems from a race condition where rq_qos_wake_function() accesses a waitqueue entry after deleting it. The bug occurs when rq_qos_wake_function() deletes the waitqueue entry before calling wake_up_process(), while simultaneously rq_qos_wait() finds it has already received a token and returns. This leads to accessing invalid memory as the waiter may have moved on to an unrelated code path, causing the system to crash when trying to access the clobbered data->task pointer (Kernel Patch). The vulnerability has been assigned a CVSS v3.1 base score of 4.7 (Medium) with vector: AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can cause system crashes due to page faults when accessing invalid memory addresses. The issue manifests as a kernel oops when trying to acquire a spinlock on an invalid task structure pointer (Red Hat).

The issue has been fixed by changing the order of operations in rq_qos_wake_function() to wake up the process before deleting the waitqueue entry, and by using list_del_init_careful() to match the list_empty_careful() in finish_wait(). System administrators should update to patched kernel versions that include the fix (Kernel Patch).