CVE-2022-50554 Details
Description
In the Linux kernel, the following vulnerability has been resolved: blk-mq: avoid double ->queue_rq() because of early timeout David Jeffery found one double ->queue_rq() issue, so far it can be triggered in VM use case because of long vmexit latency or preempt latency of vCPU pthread or long page fault in vCPU pthread, then block IO req could be timed out before queuing the request to hardware but after calling blk_mq_start_request() during ->queue_rq(), then timeout handler may handle it by requeue, then double ->queue_rq() is caused, and kernel panic. So far, it is driver's responsibility to cover the race between timeout and completion, so it seems supposed to be solved in driver in theory, given driver has enough knowledge. But it is really one common problem, lots of driver could have similar issue, and could be hard to fix all affected drivers, even it isn't easy for driver to handle the race. So David suggests this patch by draining in-progress ->queue_rq() for solving this issue.
A vulnerability in the Linux kernel's block layer can lead to a kernel panic due to a double request queueing issue. This problem arises in virtual machine scenarios where there is significant vmexit latency, preemption latency of the vCPU pthread, or prolonged page faults in the vCPU pthread. Under these conditions, block I/O requests may time out before being queued to the hardware, but after the request has been marked as started. When the timeout handler requeues the request, it causes a double queueing situation that ultimately leads to a kernel panic. Although drivers are theoretically expected to manage the timing race between request timeouts and completions, this issue is common across many drivers and can be challenging to address. The vulnerability has been resolved by implementing a mechanism to drain requests that are in the process of being queued, thereby preventing the double queueing scenario.
Users can apply the latest patches from the Linux kernel stable tree to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/7a73c54a3750895888ab586896736c9434e062a1 | kernel.org | Patch |
| https://git.kernel.org/stable/c/82c229476b8f6afd7e09bc4dc77d89dc19ff7688 | kernel.org | Patch |
| https://git.kernel.org/stable/c/8b3d6b029a552d2978bbac275303d11419826a69 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.18, < 6.0.16 >= 6.1, < 6.1.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Feb 6, 2026 | Initial Analysis | [email protected] |
| Oct 7, 2025 | New CVE Received | kernel.org |