CVE-2024-0562 is a high severity use after free flaw in Linux Kernel writeback, scored CVSS 7.8. The record lists the Linux kernel from 6.0 rc1 and Red Hat Enterprise Linux 8.0 among affected configurations. Install your distribution kernel update. Use the steps below to confirm your exposure and plan the fix.
What's affected
The record lists the Linux kernel from 6.0 rc1 and Red Hat Enterprise Linux 8.0 among affected configurations. Red Hat shipped errata, including RHSA-2024:0412 in the record references.
When a disk is removed, bdi_unregister stops write-back and waits for delayed work. The flaw is that wb_inode_writeback_end may schedule bandwidth estimation work after that wait, so a timer can touch a freed bdi_writeback.
The CVSS vector in the record is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, with a base score of 7.8 (High). KEV status: not listed in the record.
Fixed version: Install your distribution kernel update. Red Hat points to RHSA-2024:0412; other vendors publish their own errata.
How to check if you're exposed
Print the running kernel and compare it with your distribution advisory.
uname -r
# Debian or Ubuntu
apt list --installed 2>/dev/null | grep linux-image
# RHEL, Fedora and derivatives
rpm -q kernel
rpm -q --changelog kernel | grep -i CVE-2024-0562
If the changelog or your vendor advisory lists the CVE as fixed in the installed build, you are covered. Containers share the host kernel, so check the host, not the image.
What to do now
- Identify hosts and virtual machines running affected kernels.
- Install the kernel update from your distribution and reboot, or use live patching if your vendor supports it for this CVE.
- Restrict local shell access and unprivileged features where the advisory suggests it, since the flaw needs a local user.
- Rescan after patching to confirm the finding closes.
Why it matters
CWE-416 describes this class. A use after free is a memory safety bug. Code keeps using a pointer after the memory behind it has been released, so it reads or writes memory that may now belong to something else. In kernel code that can mean a crash or, in the worst case, a route to higher privileges for a local user.
The record does not mark this CVE as exploited in the wild, and it is not in the CISA KEV catalog. Published 2024-01-15.
For a wider view, a free in-browser dependency scan and the Gold directory show where Linux Kernel writeback sits in your software, and reachability analysis helps separate code that can actually be hit from code that merely ships.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2024-0562 exploited in the wild?
The record's KEV flag is false, and none of the pages I fetched said otherwise. That is not proof of safety, so still patch or restrict access.
Do containers need the kernel patch too?
Containers share the host kernel. Patch the host or node, not the container image.
Sources
- Safeguard Gold entry for CVE-2024-0562
- NVD record data for CVE-2024-0562, including the references listed there (the other reference pages were not fetched for this post).
Last reviewed: 19 October 2026.
