In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c (which is used to fill out a blk_io_trace structure and place it in a per-cpu sub-buffer).
- https://usn.ubuntu.com/4342-1/
- https://usn.ubuntu.com/4345-1/
- https://github.com/ARPSyndicate/cvemon