CVE-2022-50488
BaseFortify
Publication date: 2025-10-04
Last updated on: 2026-03-25
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 5.10 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a use-after-free (UAF) issue in the Linux kernel's block layer, specifically related to the bfq (Budget Fair Queueing) I/O scheduler. It occurs when the bfqq structure's pointer to bic (bfqq->bic) is not properly cleared when bfqq is detached from bic. This can lead to a situation where the bic structure is freed while bfqq still holds a reference to it, causing a use-after-free error. The problem arises during process movements between control groups (cgroups) and I/O operations, where multiple bfqq and bic pointers can become inconsistently linked, leading to potential memory corruption or crashes.
How can this vulnerability impact me? :
This use-after-free vulnerability can lead to memory corruption in the Linux kernel, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code with kernel privileges. Such impacts can compromise system reliability and security, especially on systems heavily using cgroups and the bfq I/O scheduler.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed in the Linux kernel by clearing bfqq->bic while bfqq is detached from bic to prevent use-after-free. Immediate mitigation involves updating your Linux kernel to a version that includes this fix (post commit 3bc5e683c67d).