CVE-2022-49995

In the Linux kernel, the following vulnerability has been resolved:

writeback: avoid use-after-free after removing device

When a disk is removed, bdi_unregister gets called to stop further writeback and wait for associated delayed work to complete. However, wb_inode_writeback_end() may schedule bandwidth estimation dwork after this has completed, which can result in the timer attempting to access the just freed bdi_writeback.

Fix this by checking if the bdi_writeback is alive, similar to when scheduling writeback work.

Since this requires wb->work_lock, and wb_inode_writeback_end() may get called from interrupt, switch wb->work_lock to an irqsafe lock.

This vulnerability is rated as Moderate severity because triggering the underlying race condition requires specific timing during block device detachment while writeback operations are actively completing, limiting practicality for local attackers. In standard Red Hat Enterprise Linux deployments, detaching storage drives is uncommon for unprivileged users and typically restricted to system administrators or automated hypervisor management. While successful exploitation could lead to a kernel crash or privilege escalation, the high execution complexity and local access requirements constrain the overall threat.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.