CVE-2022-50552

A use-after-free flaw was found in the Linux kernel block multiqueue request path during an elevator (scheduler) switch. When hardware queues are reinitialized, queue work can still run and grab a scheduler pointer that is being torn down. A local user could use this flaw to crash the system during heavy storage activity or device reset, resulting in a denial of service.

The race occurs because freezing a queue only blocks new request allocation and does not quiesce per-queue work. While the scheduler is being switched, pending run work may dereference a scheduler structure that is in teardown. The fix uses a quiesced switch so queue work cannot observe a half-torn-down scheduler.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module kyber-iosched from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.