CVE-2022-49413

In the Linux kernel, the following vulnerability has been resolved:

bfq: Update cgroup information before merging bio

When the process is migrated to a different cgroup (or in case of writeback just starts submitting bios associated with a different cgroup) bfq_merge_bio() can operate with stale cgroup information in bic. Thus the bio can be merged to a request from a different cgroup or it can result in merging of bfqqs for different cgroups or bfqqs of already dead cgroups and causing possible use-after-free issues. Fix the problem by updating cgroup information in bfq_merge_bio().

This vulnerability is rated as Low severity because triggering it requires local system access, privileges or conditions to migrate processes across control groups, and the use of the BFQ I/O scheduler, which is not configured by default on Red Hat Enterprise Linux. In typical deployments, standard I/O schedulers like mq-deadline or none are active, limiting exposure. Successful exploitation requires specific timing during active block I/O operations and would primarily lead to a kernel crash resulting in a local denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.