CVE-2022-49786

MEDIUM

Linux Kernel 5.19-6.0.9 - Use-After-Free in blkcg_css_online

Title source: llm

Description

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: properly pin the parent in blkcg_css_online blkcg_css_online is supposed to pin the blkcg of the parent, but 397c9f46ee4d refactored things and along the way, changed it to pin the css instead. This results in extra pins, and we end up leaking blkcgs and cgroups.

References (2)

Core 2

Core References

Patch

https://git.kernel.org/stable/c/d118247e404d6338f7b90636a3c6b95a387ed163

Patch

https://git.kernel.org/stable/c/d7dbd43f4a828fa1d9a8614d5b0ac40aee6375fe

Scores

CVSS v3 5.5

EPSS 0.0016

EPSS Percentile 5.6%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

Status published

Products (9)

linux/Kernel 5.19.0 - 6.0.10linux

Linux/Linux < 5.19

Linux/Linux 397c9f46ee4d99024c64954b007c1b5762d01cb4 - d118247e404d6338f7b90636a3c6b95a387ed163

Linux/Linux 397c9f46ee4d99024c64954b007c1b5762d01cb4 - d7dbd43f4a828fa1d9a8614d5b0ac40aee6375fe

Linux/Linux 5.19

Linux/Linux 6.0.10 - 6.0.*

Linux/Linux 6.1

linux/linux_kernel 6.1 rc1 (5 CPE variants)

linux/linux_kernel 5.19 - 6.0.10

Published May 01, 2025

Tracked Since Feb 18, 2026