CVE-2022-49411: bfq: Make sure bfqg for which we are queueing requests is online
First published: Wed Feb 26 2025(Updated: )
In the Linux kernel, the following vulnerability has been resolved: bfq: Make sure bfqg for which we are queueing requests is online Bios queued into BFQ IO scheduler can be associated with a cgroup that was already offlined. This may then cause insertion of this bfq_group into a service tree. But this bfq_group will get freed as soon as last bio associated with it is completed leading to use after free issues for service tree users. Fix the problem by making sure we always operate on online bfq_group. If the bfq_group associated with the bio is not online, we pick the first online parent.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | ||
| Linux Kernel | >=4.12<5.4.198 | |
| Linux Kernel | >=5.5<5.10.121 | |
| Linux Kernel | >=5.11<5.15.46 | |
| Linux Kernel | >=5.16<5.17.14 | |
| Linux Kernel | >=5.18<5.18.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/ccddf8cd411c1800863ed357064e56ceffd356bb
- https://git.kernel.org/stable/c/51f724bffa3403a5236597e6b75df7329c1ec6e9
- https://git.kernel.org/stable/c/6ee0868b0c3ccead5907685fcdcdd0c08dfe4b0b
- https://git.kernel.org/stable/c/97bd6c56bdcb41079e488e31df56809e3b2ce628
- https://git.kernel.org/stable/c/7781c38552e6cc54ed8e9040279561340516b881
- https://git.kernel.org/stable/c/075a53b78b815301f8d3dd1ee2cd99554e34f0dd
Frequently Asked Questions
What is the severity of CVE-2022-49411?
CVE-2022-49411 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2022-49411?
To fix CVE-2022-49411, it is recommended to update to the latest version of the Linux kernel where the vulnerability has been patched.
What impact does CVE-2022-49411 have on system stability?
CVE-2022-49411 can potentially lead to unstable behavior in systems using the BFQ I/O scheduler if cgroups are not managed correctly.
Is CVE-2022-49411 exploitable remotely?
CVE-2022-49411 is not considered remotely exploitable as it requires local access to the system.
Which versions of the Linux kernel are affected by CVE-2022-49411?
CVE-2022-49411 affects multiple versions of the Linux kernel prior to the security patches that address this vulnerability.
- agent/first-publish-date
- agent/type
- agent/title
- agent/references
- agent/source
- agent/author
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/event
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- vendor/linux
- canonical/linux kernel
- version/linux kernel/4.12
- version/linux kernel/5.5
- version/linux kernel/5.11
- version/linux kernel/5.16
- version/linux kernel/5.18