CVE-2022-49266

CVE-2022-49266 is a flaw in the Linux kernel’s block I/O system, specifically in how it tracks the completion of disk operations when I/O cost control (like blk-iocost) is in use.

Normally, the kernel monitors when each I/O operation finishes, so it can enforce limits or fairness policies — for example, ensuring that no single process dominates disk bandwidth. Due to a change in how certain I/O operations (called “bios”) are handled, some of them stopped reporting their completion status if they were merged with others. This broke the kernel's accounting logic, leading it to miscount active I/O.

The system could incorrectly assume that I/O operations were still in progress, causing I/O throttling policies to behave unpredictably or fail. This affects environments where disk resource control is critical — such as multi-tenant systems or containers with QoS requirements.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.