vulnerability
Ubuntu: (CVE-2022-49995): linux vulnerability
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 7 | (AV:L/AC:L/Au:S/C:C/I:C/A:C) | Jun 18, 2025 | Jun 26, 2025 | Nov 19, 2025 |
Description
In the Linux kernel, the following vulnerability has been resolved:
writeback: avoid use-after-free after removing device
When a disk is removed, bdi_unregister gets called to stop further
writeback and wait for associated delayed work to complete. However,
wb_inode_writeback_end() may schedule bandwidth estimation dwork after
this has completed, which can result in the timer attempting to access the
just freed bdi_writeback.
Fix this by checking if the bdi_writeback is alive, similar to when
scheduling writeback work.
Since this requires wb->work_lock, and wb_inode_writeback_end() may get
called from interrupt, switch wb->work_lock to an irqsafe lock.
Solutions
References
- CVE-2022-49995
- https://attackerkb.com/topics/CVE-2022-49995
- CWE-416
- URL-https://git.kernel.org/stable/c/9a6c710f3bc10bc9cc23e1c080b53245b7f9d5b7
- URL-https://git.kernel.org/stable/c/f87904c075515f3e1d8f4a7115869d3b914674fd
- URL-https://git.kernel.org/stable/c/f96b9f7c1676923bce871e728bb49c0dfa5013cc
- URL-https://www.cve.org/CVERecord?id=CVE-2022-49995
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.