CVE-2022-49411

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bfq: Make sure bfqg for which we are queueing requests is online

Bios queued into BFQ IO scheduler can be associated with a cgroup that was already offlined. This may then cause insertion of this bfq_group into a service tree. But this bfq_group will get freed as soon as last bio associated with it is completed leading to use after free issues for service tree users. Fix the problem by making sure we always operate on online bfq_group. If the bfq_group associated with the bio is not online, we pick the first online parent.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Feb 26, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2022

CVE-2022-494127.8In the Linux kernel, the following vulnerability has been resolved: bfq: Avoid merging queues with different parents It can happen that thCVE-2022-494137.8In the Linux kernel, the following vulnerability has been resolved: bfq: Update cgroup information before merging bio When the process is CVE-2022-494144.7In the Linux kernel, the following vulnerability has been resolved: ext4: fix race condition between ext4_write and ext4_convert_inline_datCVE-2022-494155.5In the Linux kernel, the following vulnerability has been resolved: ipmi:ipmb: Fix refcount leak in ipmi_ipmb_probe of_parse_phandle() retCVE-2022-494168.8In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix use-after-free in chanctx code In ieee80211_vif_usCVE-2022-494175.5In the Linux kernel, the following vulnerability has been resolved: iwlwifi: mei: fix potential NULL-ptr deref If SKB allocation fails, coCVE-2022-494185.5In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix free of uninitialized nfs4_label on referral lookup. Send aCVE-2022-494197.8In the Linux kernel, the following vulnerability has been resolved: video: fbdev: vesafb: Fix a use-after-free due early fb_info cleanup CCVE-2022-49426.1A vulnerability was found in mportuga eslint-detailed-reporter up to 0.9.0 and classified as problematic. Affected by this issue is the funcCVE-2022-494205.5In the Linux kernel, the following vulnerability has been resolved: net: annotate races around sk->sk_bound_dev_if UDP sendmsg() is lockleCVE-2022-494215.5In the Linux kernel, the following vulnerability has been resolved: video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup of_parCVE-2022-494225.5In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix the error handling path in idxd_cdev_register() I
CVE-2022-49411: High severity, CVSS 7.8 | Vulnix