CVE-2022-49786
published 2025-05-01CVE-2022-49786: In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: properly pin the parent in blkcg_css_online blkcg_css_online is supposed to pin…
PriorityP418medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.16%
5.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: properly pin the parent in blkcg_css_online
blkcg_css_online is supposed to pin the blkcg of the parent, but
397c9f46ee4d refactored things and along the way, changed it to pin the
css instead. This results in extra pins, and we end up leaking blkcgs
and cgroups.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.10-1 (bookworm) | linux 6.0.10-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 397c9f46ee4d99024c64954b007c1b5762d01cb4 < d118247e404d6338f7b90636a3c6b95a387ed163 | d118247e404d6338f7b90636a3c6b95a387ed163 |
| linux | linux | >= 397c9f46ee4d99024c64954b007c1b5762d01cb4 < d7dbd43f4a828fa1d9a8614d5b0ac40aee6375fe | d7dbd43f4a828fa1d9a8614d5b0ac40aee6375fe |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.0.10-1 | 6.0.10-1 |
| linux | linux_kernel | >= 0 < 6.0.10-1 | 6.0.10-1 |
| linux | linux_kernel | >= 0 < 6.0.10-1 | 6.0.10-1 |
| linux | linux_kernel | >= 5.19 < 6.0.10 | 6.0.10 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-ff3g-qxwq-qv29: In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: properly pin the parent in blkcg_css_online
blkcg_css_online is supp
ghsa_unreviewed·2025-05-01
CVE-2022-49786 [MEDIUM] GHSA-ff3g-qxwq-qv29: In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: properly pin the parent in blkcg_css_online
blkcg_css_online is supp
In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: properly pin the parent in blkcg_css_online
blkcg_css_online is supposed to pin the blkcg of the parent, but
397c9f46ee4d refactored things and along the way, changed it to pin the
css instead. This results in extra pins, and we end up leaking blkcgs
and cgroups.
OSV
CVE-2022-49786: In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: properly pin the parent in blkcg_css_online blkcg_css_online is suppos
osv·2025-05-01·CVSS 5.5
CVE-2022-49786 [MEDIUM] CVE-2022-49786: In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: properly pin the parent in blkcg_css_online blkcg_css_online is suppos
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: properly pin the parent in blkcg_css_online blkcg_css_online is supposed to pin the blkcg of the parent, but 397c9f46ee4d refactored things and along the way, changed it to pin the css instead. This results in extra pins, and we end up leaking blkcgs and cgroups.
Red Hat
kernel: blk-cgroup: properly pin the parent in blkcg_css_online
vendor_redhat·2025-05-01·CVSS 5.5
CVE-2022-49786 [MEDIUM] kernel: blk-cgroup: properly pin the parent in blkcg_css_online
kernel: blk-cgroup: properly pin the parent in blkcg_css_online
In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: properly pin the parent in blkcg_css_online
blkcg_css_online is supposed to pin the blkcg of the parent, but
397c9f46ee4d refactored things and along the way, changed it to pin the
css instead. This results in extra pins, and we end up leaking blkcgs
and cgroups.
Statement: A resource leak was identified in blkcg_css_online() where the current css was pinned instead of its parent, leading to extra references and memory not being freed. This issue can only be triggered by privileged users with CAP_SYS_ADMIN rights and does not allow for privilege escalation or data leakage. The leak may slowly exhaust kernel memory in systems making frequent use o
Debian
CVE-2022-49786: linux - In the Linux kernel, the following vulnerability has been resolved: blk-cgroup:...
vendor_debian·2022·CVSS 5.5
CVE-2022-49786 [MEDIUM] CVE-2022-49786: linux - In the Linux kernel, the following vulnerability has been resolved: blk-cgroup:...
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: properly pin the parent in blkcg_css_online blkcg_css_online is supposed to pin the blkcg of the parent, but 397c9f46ee4d refactored things and along the way, changed it to pin the css instead. This results in extra pins, and we end up leaking blkcgs and cgroups.
Scope: local
bookworm: resolved (fixed in 6.0.10-1)
bullseye: resolved
forky: resolved (fixed in 6.0.10-1)
sid: resolved (fixed in 6.0.10-1)
trixie: resolved (fixed in 6.0.10-1)
No detection rules found.
No public exploits indexed.
2025-05-01
Published