PT-2025-8311 · Linux+2 · Linux Kernel+2

Ming Lei · Published 2022-05-23 · Updated 2025-08-29 · CVE-2022-49377

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue in the Linux kernel has been resolved. The problem occurred in the blk-mq component, specifically in the blk mq run hw queues() function, which could be executed when there were no queued requests and after the queue was cleaned up. At this point, the tagset is freed because its lifetime is managed by the driver and is often released after blk cleanup queue() returns. To avoid this issue, the kernel no longer accesses the ->tagset to determine the current default hctx by using the mapping built into the request queue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2025-10579

CVE-2022-49377

OESA-2025-2081

OESA-2025-2082

RHSA-2025:10174

RHSA-2025:10193

SUSE-SU-2025:1027-1

SUSE-SU-2025:1176-1

SUSE-SU-2025:1183-1

SUSE-SU-2025:1241-1

SUSE-SU-2025_1027-1

SUSE-SU-2025_1241-1

Affected Products

Astra Linux

Linux Kernel

Suse

References · 1363

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49377.json · Exploit
• https://bdu.fstec.ru/vul/2025-10579 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-38124 · Security Note
• https://osv.dev/vulnerability/CVE-2022-49377 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56678 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-49377 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-22018 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:1027-1 · Vendor Advisory
• https://git.kernel.org/stable/c/b140bac470b4f707cda59c7266214246238661df · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-38464 · Security Note
• https://osv.dev/vulnerability/OESA-2025-2081 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49377 · Security Note
• https://git.kernel.org/stable/c/70fdd922c7bf8949f8df109cf2635dff64c90392 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49390 · Security Note
• https://ubuntu.com/security/CVE-2022-49377 · Vendor Advisory