PT-2025-8194 · Linux+3 · Linux Kernel+3

Published 2022-03-13 · Updated 2026-03-14 · CVE-2022-49266

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been resolved, related to the block layer and its interaction with the rq-qos (request queue quality of service) subsystem. The issue arose from a change that skipped calling rq qos done bio() for merged bios, leading to confusion in the blk-iocost controller. This caused problems such as intermediate cgroups getting stuck active, preventing their children from being activated. The vulnerability was demonstrated through a benchmark test using resctl-bench, showing poor isolation results without the fix. The issue is resolved by introducing a new flag BIO QOS MERGED to mark merged bios and calling rq qos done bio() on them, and renaming BIO TRACKED to BIO QOS THROTTLED for consistency.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

BDU:2026-03104

CVE-2022-49266

OESA-2025-1337

OESA-2025-1338

SUSE-SU-2025:1027-1

SUSE-SU-2025:1176-1

SUSE-SU-2025:1183-1

SUSE-SU-2025:1241-1

SUSE-SU-2025_1027-1

SUSE-SU-2025_1241-1

Affected Products

Astra Linux

Debian

Linux Kernel

Suse

References · 1342

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49266.json · Exploit
• https://ubuntu.com/security/CVE-2022-49266 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03104 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:1027-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49266 · Vendor Advisory
• https://git.kernel.org/stable/c/dbd20bb904ad5731aaca8d009367a930d6ada111 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49444 · Security Note
• https://osv.dev/vulnerability/OESA-2025-1337 · Vendor Advisory
• https://git.kernel.org/stable/c/09737db4c891eba25e6f6383a7c38afd4acc883f · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1241-1 · Vendor Advisory
• https://git.kernel.org/stable/c/aa1b46dcdc7baaf5fec0be25782ef24b26aa209e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49135 · Security Note
• https://osv.dev/vulnerability/OESA-2025-1338 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1176-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49266 · Security Note