CVE-2022-50530
MEDIUMCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3Description
In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix null pointer dereference in blk_mq_clear_rq_mapping() Our syzkaller report a null pointer dereference, root cause is following: __blk_mq_alloc_map_and_rqs set->tags[hctx_idx] = blk_mq_alloc_map_and_rqs blk_mq_alloc_map_and_rqs blk_mq_alloc_rqs // failed due to oom alloc_pages_node // set->tags[hctx_idx] is still NULL blk_mq_free_rqs drv_tags = set->tags[hctx_idx]; // null pointer dereference is triggered blk_mq_clear_rq_mapping(drv_tags, ...) This is because commit 63064be150e4 ("blk-mq: Add blk_mq_alloc_map_and_rqs()") merged the two steps: 1) set->tags[hctx_idx] = blk_mq_alloc_rq_map() 2) blk_mq_alloc_rqs(..., set->tags[hctx_idx]) into one step: set->tags[hctx_idx] = blk_mq_alloc_map_and_rqs() Since tags is not initialized yet in this case, fix the problem by checking if tags is NULL pointer in blk_mq_clear_rq_mapping().
Analysis
A null pointer dereference vulnerability exists in the Linux kernel's block layer (blk-mq) memory allocation path that can be triggered by a local, low-privileged user to cause a denial of service. The vulnerability affects Linux kernel versions including 6.1-rc1 and potentially other versions where a failed memory allocation during block queue tag initialization leaves a dangling pointer that is later dereferenced during cleanup. While the EPSS score is low (0.02%, percentile 4%), the vulnerability is straightforward to trigger under memory pressure conditions, requires only local access with minimal privileges, and has vendor patches available.
Technical Context
This vulnerability resides in the Linux kernel's block I/O subsystem, specifically in the block-mq (multi-queue block device) tag allocation logic. The root cause is classified as CWE-476 (Null Pointer Dereference) and stems from a code consolidation in commit 63064be150e4 that merged two previously separate initialization steps into a single function call (blk_mq_alloc_map_and_rqs). When this consolidated function fails due to memory exhaustion during the alloc_pages_node call, the set->tags array element remains uninitialized but is later accessed by blk_mq_free_rqs during error cleanup, triggering the null pointer dereference in blk_mq_clear_rq_mapping. The affected products are identified via CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* and cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*, indicating any Linux kernel version could be affected depending on backport status.
Affected Products
The Linux kernel is affected across multiple versions, with confirmed impact for version 6.1-rc1 per the CPE data (cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*). The generic CPE (cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*) indicates that any kernel version with the consolidated blk_mq_alloc_map_and_rqs function from commit 63064be150e4 onwards may be vulnerable. All Linux distributions shipping affected kernel versions—including Red Hat Enterprise Linux, Ubuntu, Debian, SUSE Linux, and others—are potentially impacted. Vendor patches are available from the Linux kernel stable repository at https://git.kernel.org/stable/c/6a440e6d04431e774dc084abe88c106e2a474c1a and https://git.kernel.org/stable/c/76dd298094f484c6250ebd076fa53287477b2328.
Remediation
Apply the Linux kernel security patch immediately by updating to a kernel version that includes the fix commits 6a440e6d04431e774dc084abe88c106e2a474c1a or 76dd298094f484c6250ebd076fa53287477b2328. For distributions, this typically means upgrading to the latest stable kernel version (6.1 release or later, or backported patches for earlier stable series). Most Linux vendors provide patched kernel packages through their standard update mechanisms; refer to your distribution's security advisory for specific version numbers. Until patching is completed, the attack surface can be minimized by restricting local user privileges and disabling unnecessary block device memory-intensive operations if feasible. If kernel update cannot be immediately deployed due to system stability concerns, monitor system logs for kernel panics related to block device tag allocation failures as a temporary detection mechanism.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today