CVE-2015-9016 in Android
Summary
by MITRE
In blk_mq_tag_to_rq in blk-mq.c in the upstream kernel, there is a possible use after free due to a race condition when a request has been previously freed by blk_mq_complete_request. This could lead to local escalation of privilege. Product: Android. Versions: Android kernel. Android ID: A-63083046.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/14/2025
The vulnerability identified as CVE-2015-9016 represents a critical race condition flaw within the Linux kernel's block multi-queue subsystem, specifically in the blk_mq_tag_to_rq function located in blk-mq.c. This issue manifests as a use-after-free condition that occurs when the kernel's block I/O subsystem handles request completion and tag management concurrently. The vulnerability is particularly concerning because it exists within the core kernel components that manage storage I/O operations, making it a prime target for privilege escalation attacks. The race condition arises when multiple threads or processes attempt to access a request structure that has already been freed by the blk_mq_complete_request function, creating a scenario where memory that has been deallocated is still being referenced or modified.
The technical implementation of this vulnerability involves the kernel's block multi-queue architecture which manages multiple hardware queues for improved I/O performance. When a request completes processing, the blk_mq_complete_request function is responsible for cleaning up and freeing the associated request structure. However, due to insufficient synchronization mechanisms, another thread might attempt to access this freed memory through the blk_mq_tag_to_rq function, which maps tags to request structures. This race condition can be exploited by malicious processes to manipulate the freed memory contents, potentially leading to arbitrary code execution with kernel privileges. The vulnerability is classified under CWE-416 as Use After Free, which is a well-known class of memory safety issues that frequently results in privilege escalation and system compromise.
The operational impact of CVE-2015-9016 is severe as it provides local attackers with a pathway to escalate privileges from user-level to kernel-level execution. This means that any process running on an affected Android device could potentially leverage this vulnerability to gain root access to the system, effectively bypassing all security controls and user permissions. The attack vector is particularly dangerous because it requires no network connectivity or user interaction, making it a silent threat that can be exploited by malware or malicious applications already present on the device. The vulnerability affects Android kernel implementations that utilize the block multi-queue subsystem, which is standard across modern Android devices, making it widespread and highly impactful.
Mitigation strategies for this vulnerability require immediate kernel updates and patches from Android vendors, as the flaw exists at the core kernel level and cannot be addressed through application-level fixes alone. System administrators and device manufacturers should prioritize deploying kernel updates that include proper synchronization mechanisms to prevent the race condition between blk_mq_complete_request and blk_mq_tag_to_rq functions. The fix typically involves implementing appropriate locking mechanisms or memory barrier operations to ensure that request structures are not accessed after being freed, which aligns with ATT&CK technique T1068 for exploit for privilege escalation. Additionally, organizations should implement runtime monitoring to detect anomalous memory access patterns that might indicate exploitation attempts, and consider implementing kernel address space layout randomization to make exploitation more difficult. The vulnerability serves as a reminder of the critical importance of proper concurrency control in kernel-level code and the potential catastrophic consequences when such controls are inadequate.