CVE-2022-49689

[REJECTED CVE] A vulnerability was identified in the Linux kernel’s xen-blkfront driver, where failing to fully initialize a virtual block device (VBD) before detaching it could lead to a NULL pointer dereference due to gendisk being NULL. An attacker with control over a guest VM could exploit this by attaching an invalid or non-existent backend device and then detaching it, triggering a kernel crash or denial of service in the host through a NULL dereference during cleanup in blkfront_closing().

This CVE has been rejected upstream: https://lore.kernel.org/linux-cve-announce/2025022602-REJECTED-aafa@gregkh/

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.