CVE-2022-49995: writeback: avoid use-after-free after removing device

Published Jun 18, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

writeback: avoid use-after-free after removing device

When a disk is removed, bdiunregister gets called to stop further writeback and wait for associated delayed work to complete. However, wbinodewritebackend() may schedule bandwidth estimation dwork after this has completed, which can result in the timer attempting to access the just freed bdiwriteback.

Fix this by checking if the bdiwriteback is alive, similar to when scheduling writeback work.

Since this requires wb->worklock, and wbinodewritebackend() may get called from interrupt, switch wb->worklock to an irqsafe lock.

Affected Software

112 affected componentsFixes available
Linux Foundation Linux Kernel
Linux Linux kernel>=5.15<5.15.64
Linux Linux kernel>=5.16<5.19.6
Linux Linux kernel=6.0-rc1
Linux Linux kernel=6.0-rc2
debian/linux<6.0.2-1
6.0.2-1
debian/linux<6.0.2-1
6.0.2-1
debian/linux<6.0.2-1
6.0.2-1
debian/linux
6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1
ubuntu/linux-hwe-edge*
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-azure*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-edge*
ubuntu/linux-oem*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-aws-5.15<5.15.0-1023.27~20.04.1
5.15.0-1023.27~20.04.1
ubuntu/linux-azure-5.15<5.15.0-1023.29~20.04.1
5.15.0-1023.29~20.04.1
ubuntu/linux-gcp-5.15<5.15.0-1022.29~20.04.1
5.15.0-1022.29~20.04.1
ubuntu/linux-hwe-5.15<5.15.0-53.59~20.04.1
5.15.0-53.59~20.04.1
ubuntu/linux-intel-iotg-5.15<5.15.0-1018.23~20.04.1
5.15.0-1018.23~20.04.1
ubuntu/linux-lowlatency-hwe-5.15<5.15.0-53.59~20.04.1
5.15.0-53.59~20.04.1
ubuntu/linux-oracle-5.15<5.15.0-1022.28~20.04.1
5.15.0-1022.28~20.04.1
ubuntu/linux-riscv-5.15<5.15.0-1023.27~20.04.1
5.15.0-1023.27~20.04.1
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-gkeop*
ubuntu/linux-gkeop-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.8*
ubuntu/linux-intel-5.13*
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.8*
ubuntu/linux<5.15.0-53.59
5.15.0-53.59
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws<5.15.0-1023.27
5.15.0-1023.27
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-aws-6.5*
ubuntu/linux-azure<5.15.0-1023.29
5.15.0-1023.29
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-6.5*
ubuntu/linux-azure-fde<5.15.0-1024.30.1
5.15.0-1024.30.1
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-gcp<5.15.0-1022.29
5.15.0-1022.29
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-gcp-6.5*
ubuntu/linux-gke<5.15.0-1020.25
5.15.0-1020.25
ubuntu/linux-gkeop<5.15.0-1008.12
5.15.0-1008.12
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-hwe-6.5*
ubuntu/linux-ibm<5.15.0-1018.21
5.15.0-1018.21
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-intel-iotg<5.15.0-1018.23
5.15.0-1018.23
ubuntu/linux-kvm<5.15.0-1021.26
5.15.0-1021.26
ubuntu/linux-lowlatency<5.15.0-53.59
5.15.0-53.59
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-lowlatency-hwe-6.5*
ubuntu/linux-nvidia<5.15.0-1015.15
5.15.0-1015.15
ubuntu/linux-nvidia-6.2*
ubuntu/linux-nvidia-6.5*
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-oem-6.5*
ubuntu/linux-oracle<5.15.0-1022.28
5.15.0-1022.28
ubuntu/linux-oracle-6.5*
ubuntu/linux-raspi<5.15.0-1018.20
5.15.0-1018.20
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-riscv-6.5*
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-starfive-6.5*
ubuntu/linux-realtime<5.15.0-1025.28
5.15.0-1025.28
ubuntu/linux-raspi-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.0.2-1
  2. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
  3. Upgrade

    Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1023.27~20.04.1
  4. Upgrade

    Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1023.29~20.04.1
  5. Upgrade

    Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1022.29~20.04.1
  6. Upgrade

    Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-53.59~20.04.1
  7. Upgrade

    Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1018.23~20.04.1
  8. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-53.59~20.04.1
  9. Upgrade

    Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1022.28~20.04.1
  10. Upgrade

    Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1023.27~20.04.1
  11. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.15.0-53.59
  12. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.15.0-1023.27
  13. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.15.0-1023.29
  14. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 5.15.0-1024.30.1
  15. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1022.29
  16. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 5.15.0-1020.25
  17. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 5.15.0-1008.12
  18. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1018.21
  19. Upgrade

    Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.

    Fixed in 5.15.0-1018.23
  20. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1021.26
  21. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 5.15.0-53.59
  22. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 5.15.0-1015.15
  23. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.15.0-1022.28
  24. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.15.0-1018.20
  25. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1025.28
  26. Compensating control

    Check whether bdi_writeback is still alive before scheduling writeback work, including bandwidth-estimation delayed work, to prevent access after the device is removed.

  27. Compensating control

    Switch wb->work_lock to an IRQ-safe lock so bdi_unregister can wait for associated delayed work while wb_inode_writeback_end() may be called from interrupt context.

Event History

Jun 18, 2025
CVE Published
via MITRE·11:00 AM
Data Sourced
via MITRE·11:00 AM
DescriptionSeverity
Data Sourced
via OSV·11:15 AM
DescriptionSeverityAffected Software
Data Sourced
via NVD·11:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via Red Hat·12:08 PM
DescriptionSeverityAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2022-49995?

CVE-2022-49995 has been classified as a high severity vulnerability affecting the Linux kernel.

2

How do I fix CVE-2022-49995?

To address CVE-2022-49995, update your Linux kernel to the latest patched version provided by your distribution.

3

What are the potential impacts of CVE-2022-49995?

Exploiting CVE-2022-49995 may lead to a use-after-free condition, potentially allowing an attacker to execute arbitrary code.

4

Which versions of the Linux kernel are affected by CVE-2022-49995?

CVE-2022-49995 affects several versions of the Linux kernel prior to the release of patches addressing the vulnerability.

5

How was CVE-2022-49995 discovered?

CVE-2022-49995 was discovered during routine security audits and testing of the Linux kernel related to device removal processes.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203