CVE-2022-49694 Details
Description
In the Linux kernel, the following vulnerability has been resolved: block: disable the elevator int del_gendisk The elevator is only used for file system requests, which are stopped in del_gendisk. Move disabling the elevator and freeing the scheduler tags to the end of del_gendisk instead of doing that work in disk_release and blk_cleanup_queue to avoid a use after free on q->tag_set from disk_release as the tag_set might not be alive at that point. Move the blk_qos_exit call as well, as it just depends on the elevator exit and would be the only reason to keep the not exactly cheap queue freeze in disk_release.
A use-after-free vulnerability has been identified in the Linux kernel related to the management of disk schedulers. The issue arises because the elevator, which is responsible for handling file system requests, is disabled in the 'del_gendisk' function. This creates a timing problem where the scheduler's tags can be freed while they are still in use, leading to a use-after-free condition. The vulnerability has been addressed by changing the order of operations: the elevator is now disabled and the scheduler tags are freed at the end of the 'del_gendisk' process, rather than in 'disk_release' or 'blk_cleanup_queue'. This adjustment ensures that the tag_set is valid and prevents the use-after-free scenario.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 5, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/50e34d78815e474d410f342fbe783b18192ca518 | kernel.org | Patch |
| https://git.kernel.org/stable/c/f28699fafc047ec33299da01e928c3a0073c5cc6 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.16, < 5.18.8 5.19 rc1 5.19 rc2 5.19 rc3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 24, 2025 | Initial Analysis | [email protected] |
| Mar 5, 2025 | CVE Modified | CISA-ADP |
| Feb 26, 2025 | New CVE Received | kernel.org |