Answer in brief
CVE-2024-56693 records a Unknown severity vulnerability in brd: defer automatic disk creation until module initialization succeeds. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2024-56693 records a Unknown severity vulnerability in brd: defer automatic disk creation until module initialization succeeds. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=7f9b348cb5e94259acdcbafbcaed55d3bb515304 <41219c147df8bbd6591f59af5d695fb6c9a1cbff || >=7f9b348cb5e94259acdcbafbcaed55d3bb515304 <259bf925583ec9e3781df778cadf00594095090d || >=7f9b348cb5e94259acdcbafbcaed55d3bb515304 <410896624db639500f24f46478b4bfa05c76bf56 || >=7f9b348cb5e94259acdcbafbcaed55d3bb515304 <c0c2744cd2939ec5999c51dbaf2af16886548b7b || >=7f9b348cb5e94259acdcbafbcaed55d3bb515304 <63dfd728b30f79495dacc886127695a379805152 || >=7f9b348cb5e94259acdcbafbcaed55d3bb515304 <826cc42adf44930a633d11a5993676d85ddb0842 | 41219c147df8bbd6591f59af5d695fb6c9a1cbff, 259bf925583ec9e3781df778cadf00594095090d, 410896624db639500f24f46478b4bfa05c76bf56, c0c2744cd2939ec5999c51dbaf2af16886548b7b, 63dfd728b30f79495dacc886127695a379805152, 826cc42adf44930a633d11a5993676d85ddb0842 |
| Linux/Linuxgeneric | 5.14 | Not reported |
Published upstream
Dec 28, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: brd: defer automatic disk creation until module initialization succeeds My colleague Wupeng found the following problems during fault injection: BUG: unable to handle page fault for address: fffffbfff809d073 PGD 6e648067 P4D 123ec8067 PUD 123ec4067 PMD 100e38067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 5 UID: 0 PID: 755 Comm: modprobe Not tainted 6.12.0-rc3+ #17 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:__asan_load8+0x4c/0xa0 ... Call Trace: <TASK> blkdev_put_whole+0x41/0x70 bdev_release+0x1a3/0x250 blkdev_release+0x11/0x20 __fput+0x1d7/0x4a0 task_work_run+0xfc/0x180 syscall_exit_to_user_mode+0x1de/0x1f0 do_syscall_64+0x6b/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e loop_init() is calling loop_add() after __register_blkdev() succeeds and is ignoring disk_add() failure from loop_add(), for loop_add() failure is not fatal and successfully created disks are already visible to bdev_open(). brd_init() is currently calling brd_alloc() before __register_blkdev() succeeds and is releasing successfully created disks when brd_init() returns an error. This can cause UAF for the latter two case: case 1: T1: modprobe brd brd_init brd_alloc(0) // success add_disk disk_scan_partitions bdev_file_open_by_dev // alloc file fput // won't free until back to userspace brd_alloc(1) // failed since mem alloc error inject // error path for modprobe will release code segment // back to userspace __fput blkdev_release bdev_release blkdev_put_whole bdev->bd_disk->fops->release // fops is freed now, UAF! case 2: T1: T2: modprobe brd brd_init brd_alloc(0) // success open(/dev/ram0) brd_alloc(1) // fail // error path for modprobe close(/dev/ram0) ... /* UAF! */ bdev->bd_disk->fops->release Fix this problem by following what loop_init() does. Besides, reintroduce brd_devices_mutex to help serialize modifications to brd_list.
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=7f9b348cb5e94259acdcbafbcaed55d3bb515304 <41219c147df8bbd6591f59af5d695fb6c9a1cbff || >=7f9b348cb5e94259acdcbafbcaed55d3bb515304 <259bf925583ec9e3781df778cadf00594095090d || >=7f9b348cb5e94259acdcbafbcaed55d3bb515304 <410896624db639500f24f46478b4bfa05c76bf56 || >=7f9b348cb5e94259acdcbafbcaed55d3bb515304 <c0c2744cd2939ec5999c51dbaf2af16886548b7b || >=7f9b348cb5e94259acdcbafbcaed55d3bb515304 <63dfd728b30f79495dacc886127695a379805152 || >=7f9b348cb5e94259acdcbafbcaed55d3bb515304 <826cc42adf44930a633d11a5993676d85ddb0842 | 41219c147df8bbd6591f59af5d695fb6c9a1cbff, 259bf925583ec9e3781df778cadf00594095090d, 410896624db639500f24f46478b4bfa05c76bf56, c0c2744cd2939ec5999c51dbaf2af16886548b7b, 63dfd728b30f79495dacc886127695a379805152, 826cc42adf44930a633d11a5993676d85ddb0842 |
| Linux/Linuxgeneric | 5.14 | Not reported |
Published upstream
Dec 28, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: brd: defer automatic disk creation until module initialization succeeds My colleague Wupeng found the following problems during fault injection: BUG: unable to handle page fault for address: fffffbfff809d073 PGD 6e648067 P4D 123ec8067 PUD 123ec4067 PMD 100e38067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 5 UID: 0 PID: 755 Comm: modprobe Not tainted 6.12.0-rc3+ #17 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:__asan_load8+0x4c/0xa0 ... Call Trace: <TASK> blkdev_put_whole+0x41/0x70 bdev_release+0x1a3/0x250 blkdev_release+0x11/0x20 __fput+0x1d7/0x4a0 task_work_run+0xfc/0x180 syscall_exit_to_user_mode+0x1de/0x1f0 do_syscall_64+0x6b/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e loop_init() is calling loop_add() after __register_blkdev() succeeds and is ignoring disk_add() failure from loop_add(), for loop_add() failure is not fatal and successfully created disks are already visible to bdev_open(). brd_init() is currently calling brd_alloc() before __register_blkdev() succeeds and is releasing successfully created disks when brd_init() returns an error. This can cause UAF for the latter two case: case 1: T1: modprobe brd brd_init brd_alloc(0) // success add_disk disk_scan_partitions bdev_file_open_by_dev // alloc file fput // won't free until back to userspace brd_alloc(1) // failed since mem alloc error inject // error path for modprobe will release code segment // back to userspace __fput blkdev_release bdev_release blkdev_put_whole bdev->bd_disk->fops->release // fops is freed now, UAF! case 2: T1: T2: modprobe brd brd_init brd_alloc(0) // success open(/dev/ram0) brd_alloc(1) // fail // error path for modprobe close(/dev/ram0) ... /* UAF! */ bdev->bd_disk->fops->release Fix this problem by following what loop_init() does. Besides, reintroduce brd_devices_mutex to help serialize modifications to brd_list.
Quoted source text, attributed separately from HOL analysis.