CVE-2022-49411

A use-after-free vulnerability exists in the Linux kernel. The Bios queued into the BFQ IO scheduler can be associated with a cgroup that was already offline. This issue may then cause the insertion of this bfq_group into a service tree. This bfq_group will get freed as soon as the last associated bio is completed, leading to use-after-free issues for service tree users and denial of service issues.

This vulnerability is rated as having a Moderate impact because exploitation requires local administrative privileges to configure cgroups and manipulate active I/O requests, limiting the attack surface. Standard Red Hat Enterprise Linux installations default to multi-queue schedulers such as mq-deadline or none, meaning the BFQ scheduler is not enabled by default for most block devices. Consequently, triggering this use-after-free condition requires non-default scheduling configurations combined with concurrent cgroup offlining, reducing the risk of accidental or unprivileged exploitation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.