CVE-2022-49465

A flaw was found in the Linux kernel's block throttling subsystem. When block input/output (I/O) requests are throttled, a timing race can allow a request structure to be completed and freed before its status flag is set. A local user could exploit this use-after-free condition by submitting I/O requests, potentially causing a system crash and Denial of Service (DoS) or unauthorized memory access.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires local access and is constrained to systems where I/O throttling policies are actively configured on cgroups. Under specific race conditions during throttled storage operations, asynchronous completion can trigger a use-after-free scenario within the kernel. While an unprivileged local user could induce a kernel crash resulting in a denial of service, arbitrary code execution or information disclosure is substantially limited by race timing and kernel memory protections.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.