CVE-2022-50554
published 2025-10-07CVE-2022-50554: In the Linux kernel, the following vulnerability has been resolved: blk-mq: avoid double ->queue_rq() because of early timeout David Jeffery found one double…
PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.19%
8.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
blk-mq: avoid double ->queue_rq() because of early timeout
David Jeffery found one double ->queue_rq() issue, so far it can
be triggered in VM use case because of long vmexit latency or preempt
latency of vCPU pthread or long page fault in vCPU pthread, then block
IO req could be timed out before queuing the request to hardware but after
calling blk_mq_start_request() during ->queue_rq(), then timeout handler
may handle it by requeue, then double ->queue_rq() is caused, and kernel
panic.
So far, it is driver's responsibility to cover the race between timeout
and completion, so it seems supposed to be solved in driver in theory,
given driver has enough knowledge.
But it is really one common problem, lots of driver could have similar
issue, and could be hard to fix all affected drivers, even it isn't easy
for driver to handle the race. So David suggests this patch by draining
in-progress ->queue_rq() for solving this issue.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.4-1 (bookworm) | linux 6.1.4-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 12f5b93145450c750f315657ef239a314811aeeb < 7a73c54a3750895888ab586896736c9434e062a1 | 7a73c54a3750895888ab586896736c9434e062a1 |
| linux | linux | >= 12f5b93145450c750f315657ef239a314811aeeb < 8b3d6b029a552d2978bbac275303d11419826a69 | 8b3d6b029a552d2978bbac275303d11419826a69 |
| linux | linux | >= 12f5b93145450c750f315657ef239a314811aeeb < 82c229476b8f6afd7e09bc4dc77d89dc19ff7688 | 82c229476b8f6afd7e09bc4dc77d89dc19ff7688 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 4.18 < 6.0.16 | 6.0.16 |
| linux | linux_kernel | >= 6.1 < 6.1.2 | 6.1.2 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.0.15/6.1.1 driver queue_rq memory corruption (Nessus ID 284764 / WID-SEC-2025-2229)
vuldb·2026-04-20·CVSS 5.5
CVE-2022-50554 [MEDIUM] Linux Kernel up to 6.0.15/6.1.1 driver queue_rq memory corruption (Nessus ID 284764 / WID-SEC-2025-2229)
A vulnerability identified as critical has been detected in Linux Kernel up to 6.0.15/6.1.1. This affects the function queue_rq of the component driver. Performing a manipulation results in memory corruption.
This vulnerability was named CVE-2022-50554. The attack needs to be approached within the local network. There is no available exploit.
You should upgrade the affected component.
GHSA
GHSA-rmfg-487h-3qfx: In the Linux kernel, the following vulnerability has been resolved:
blk-mq: avoid double ->queue_rq() because of early timeout
David Jeffery found o
ghsa_unreviewed·2025-10-07
CVE-2022-50554 [MEDIUM] GHSA-rmfg-487h-3qfx: In the Linux kernel, the following vulnerability has been resolved:
blk-mq: avoid double ->queue_rq() because of early timeout
David Jeffery found o
In the Linux kernel, the following vulnerability has been resolved:
blk-mq: avoid double ->queue_rq() because of early timeout
David Jeffery found one double ->queue_rq() issue, so far it can
be triggered in VM use case because of long vmexit latency or preempt
latency of vCPU pthread or long page fault in vCPU pthread, then block
IO req could be timed out before queuing the request to hardware but after
calling blk_mq_start_request() during ->queue_rq(), then timeout handler
may handle it by requeue, then double ->queue_rq() is caused, and kernel
panic.
So far, it is driver's responsibility to cover the race between timeout
and completion, so it seems supposed to be solved in driver in theory,
given driver has enough knowledge.
But it is really one common problem, lots of driver could
OSV
CVE-2022-50554: In the Linux kernel, the following vulnerability has been resolved: blk-mq: avoid double ->queue_rq() because of early timeout David Jeffery found one
osv·2025-10-07·CVSS 5.5
CVE-2022-50554 [MEDIUM] CVE-2022-50554: In the Linux kernel, the following vulnerability has been resolved: blk-mq: avoid double ->queue_rq() because of early timeout David Jeffery found one
In the Linux kernel, the following vulnerability has been resolved: blk-mq: avoid double ->queue_rq() because of early timeout David Jeffery found one double ->queue_rq() issue, so far it can be triggered in VM use case because of long vmexit latency or preempt latency of vCPU pthread or long page fault in vCPU pthread, then block IO req could be timed out before queuing the request to hardware but after calling blk_mq_start_request() during ->queue_rq(), then timeout handler may handle it by requeue, then double ->queue_rq() is caused, and kernel panic. So far, it is driver's responsibility to cover the race between timeout and completion, so it seems supposed to be solved in driver in theory, given driver has enough knowledge. But it is really one common problem, lots of driver could hav
Red Hat
kernel: blk-mq: avoid double ->queue_rq() because of early timeout
vendor_redhat·2025-10-07·CVSS 5.5
CVE-2022-50554 [MEDIUM] CWE-820 kernel: blk-mq: avoid double ->queue_rq() because of early timeout
kernel: blk-mq: avoid double ->queue_rq() because of early timeout
In the Linux kernel, the following vulnerability has been resolved:
blk-mq: avoid double ->queue_rq() because of early timeout
David Jeffery found one double ->queue_rq() issue, so far it can
be triggered in VM use case because of long vmexit latency or preempt
latency of vCPU pthread or long page fault in vCPU pthread, then block
IO req could be timed out before queuing the request to hardware but after
calling blk_mq_start_request() during ->queue_rq(), then timeout handler
may handle it by requeue, then double ->queue_rq() is caused, and kernel
panic.
So far, it is driver's responsibility to cover the race between timeout
and completion, so it seems supposed to be solved in driver in theory,
given driver has enough know
Debian
CVE-2022-50554: linux - In the Linux kernel, the following vulnerability has been resolved: blk-mq: avo...
vendor_debian·2022·CVSS 5.5
CVE-2022-50554 [MEDIUM] CVE-2022-50554: linux - In the Linux kernel, the following vulnerability has been resolved: blk-mq: avo...
In the Linux kernel, the following vulnerability has been resolved: blk-mq: avoid double ->queue_rq() because of early timeout David Jeffery found one double ->queue_rq() issue, so far it can be triggered in VM use case because of long vmexit latency or preempt latency of vCPU pthread or long page fault in vCPU pthread, then block IO req could be timed out before queuing the request to hardware but after calling blk_mq_start_request() during ->queue_rq(), then timeout handler may handle it by requeue, then double ->queue_rq() is caused, and kernel panic. So far, it is driver's responsibility to cover the race between timeout and completion, so it seems supposed to be solved in driver in theory, given driver has enough knowledge. But it is really one common problem, lots of driver could hav
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-07
Published