Executive Summary

This vulnerability is a use-after-free bug in the Linux kernel's network scheduler component called taprio, specifically in the advance_sched() function during a schedule switch.

When the function should_change_schedules() returns true, switch_schedules() is called to promote the admin schedule to operational. However, switch_schedules() queues the old operational schedule for deferred freeing, but a pointer named 'next' still references an entry in the old schedule.

Subsequent operations use this 'next' pointer after the old schedule has been freed, causing a use-after-free condition. The fix involves selecting 'next' from the new operational schedule immediately after switching schedules and using its pre-calculated end_time to avoid accessing freed memory.

Useful 0 Not Useful 0

Impact Analysis

This use-after-free vulnerability can lead to undefined behavior in the Linux kernel, such as system crashes, memory corruption, or potential escalation of privileges if exploited.

Because it occurs in the network scheduler, it might be triggered during network traffic scheduling operations, potentially affecting system stability and reliability.

Useful 0 Not Useful 0