CVE-2022-49411

bfq: Make sure bfqg for which we are queueing requests is online

High · published February 26, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
20.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

bfq: Make sure bfqg for which we are queueing requests is online

Bios queued into BFQ IO scheduler can be associated with a cgroup that

was already offlined. This may then cause insertion of this bfq_group

into a service tree. But this bfq_group will get freed as soon as last

bio associated with it is completed leading to use after free issues for

service tree users. Fix the problem by making sure we always operate on

online bfq_group. If the bfq_group associated with the bio is not

online, we pick the first online parent.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00289 · 20.3th percentile
Published
2025-02-26T02:12Z
EPSS history
Timeline
  • 26 FEB 02:12Z
    bfq: Make sure bfqg for which we are queueing requests is online
    cvelistv5