CVE-2022-49986
BaseFortify
Publication date: 2025-06-18
Last updated on: 2025-11-14
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.0 |
| linux | linux_kernel | 6.0 |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-667 | The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the Linux kernel's storvsc driver workqueue named storvsc_error_wq being incorrectly marked with the WQ_MEM_RECLAIM flag. This flag indicates that the workqueue should make forward progress under memory pressure, but storvsc_error_wq does not require this. Marking it as WQ_MEM_RECLAIM can cause a deadlock when flushing a non-WQ_MEM_RECLAIM workqueue, leading to kernel warnings and potential system instability.
How can this vulnerability impact me? :
The impact of this vulnerability is that it can cause deadlocks in the Linux kernel when the storvsc_error_wq workqueue is flushed. This can lead to system instability, kernel warnings, and potentially affect the availability or reliability of systems using the affected storvsc driver, especially in virtualized environments.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the system logs for specific kernel warning messages related to the storvsc_error_wq workqueue. Look for messages similar to: "workqueue: WQ_MEM_RECLAIM storvsc_error_wq_0:storvsc_remove_lun is flushing !WQ_MEM_RECLAIM" or kernel warnings referencing check_flush_dependency in workqueue.c. You can use commands like 'dmesg | grep storvsc_error_wq' or 'journalctl -k | grep storvsc_error_wq' to find these warnings in the kernel logs.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where the storvsc_error_wq workqueue is no longer marked as WQ_MEM_RECLAIM, as this change resolves the deadlock and warning issue. If updating is not immediately possible, monitoring for the warning messages and avoiding conditions that trigger the workqueue flushing under memory pressure may help reduce impact.