cbcvebase.
CVE-2022-49411
published 2025-02-26

CVE-2022-49411: In the Linux kernel, the following vulnerability has been resolved: bfq: Make sure bfqg for which we are queueing requests is online Bios queued into BFQ IO…

PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.29%
21.2th percentile
In the Linux kernel, the following vulnerability has been resolved: bfq: Make sure bfqg for which we are queueing requests is online Bios queued into BFQ IO scheduler can be associated with a cgroup that was already offlined. This may then cause insertion of this bfq_group into a service tree. But this bfq_group will get freed as soon as last bio associated with it is completed leading to use after free issues for service tree users. Fix the problem by making sure we always operate on online bfq_group. If the bfq_group associated with the bio is not online, we pick the first online parent.

Affected

17 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 5.18.5-1 (bookworm)linux 5.18.5-1 (bookworm)
linuxlinux——
linuxlinux>= e21b7a0b988772e82e7147e1c659a5afe2ae003c < ccddf8cd411c1800863ed357064e56ceffd356bbccddf8cd411c1800863ed357064e56ceffd356bb
linuxlinux>= e21b7a0b988772e82e7147e1c659a5afe2ae003c < 51f724bffa3403a5236597e6b75df7329c1ec6e951f724bffa3403a5236597e6b75df7329c1ec6e9
linuxlinux>= e21b7a0b988772e82e7147e1c659a5afe2ae003c < 6ee0868b0c3ccead5907685fcdcdd0c08dfe4b0b6ee0868b0c3ccead5907685fcdcdd0c08dfe4b0b
linuxlinux>= e21b7a0b988772e82e7147e1c659a5afe2ae003c < 97bd6c56bdcb41079e488e31df56809e3b2ce62897bd6c56bdcb41079e488e31df56809e3b2ce628
linuxlinux>= e21b7a0b988772e82e7147e1c659a5afe2ae003c < 7781c38552e6cc54ed8e9040279561340516b8817781c38552e6cc54ed8e9040279561340516b881
linuxlinux>= e21b7a0b988772e82e7147e1c659a5afe2ae003c < 075a53b78b815301f8d3dd1ee2cd99554e34f0dd075a53b78b815301f8d3dd1ee2cd99554e34f0dd
linuxlinux_kernel>= 0 < 5.10.127-15.10.127-1
linuxlinux_kernel>= 0 < 5.18.5-15.18.5-1
linuxlinux_kernel>= 0 < 5.18.5-15.18.5-1
linuxlinux_kernel>= 0 < 5.18.5-15.18.5-1
linuxlinux_kernel>= 4.12 < 5.4.1985.4.198
linuxlinux_kernel>= 5.11 < 5.15.465.15.46
linuxlinux_kernel>= 5.16 < 5.17.145.17.14
linuxlinux_kernel>= 5.18 < 5.18.35.18.3
linuxlinux_kernel>= 5.5 < 5.10.1215.10.121

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.