PT-2025-26012 · Linux+4 · Linux Kernel+4

Published 2022-07-20 · Updated 2026-03-14 · CVE-2022-50086

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been resolved, related to the block layer and the blk-rq-qos framework. The issue occurs when the io.cost.qos file is written by two CPUs concurrently, potentially leading to list add/del corruptions of the inner walk list in the ioc timer fn function. This happens because two iocs may be enabled and running on one disk, owning different iocgs on their active list, and overwriting each other's root iocg's walk list. The vulnerability is related to the rq qos add function and the ioc variable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-253

Related Identifiers

BDU:2026-04510

CVE-2022-50086

RHSA-2023:2458

RHSA-2023_2458

SUSE-SU-2025:02264-1

SUSE-SU-2025:02321-1

SUSE-SU-2025:2264-1

SUSE-SU-2025_02264-1

Affected Products

Astra Linux

Debian

Linux Kernel

Red Hat

Suse

References · 585

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50086.json · Exploit
• https://git.kernel.org/stable/c/0b7f5d7a4d2a72ad9de04ab8ccba2a31904aa638 · Patch
• https://osv.dev/vulnerability/CVE-2022-50086 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-50086 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2022-50086 · Vendor Advisory
• https://git.kernel.org/stable/c/08ef66e800a85afc6b54cb95841f6502627eee2e · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-50086 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02321-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-50086 · Vendor Advisory
• https://git.kernel.org/stable/c/14a6e2eb7df5c7897c15b109cba29ab0c4a791b6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-50086 · Security Note
• https://git.kernel.org/stable/c/0c9bb1acd1d103a3070b2126870eb52761d606ce · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-50086 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-50086 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04510 · Security Note