GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49465 (GCVE-0-2022-49465)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:13 – Updated: 2026-08-05 08:55
VLAI
Title
blk-throttle: Set BIO_THROTTLED when bio has been throttled
Summary
In the Linux kernel, the following vulnerability has been resolved: blk-throttle: Set BIO_THROTTLED when bio has been throttled 1.In current process, all bio will set the BIO_THROTTLED flag after __blk_throtl_bio(). 2.If bio needs to be throttled, it will start the timer and stop submit bio directly. Bio will submit in blk_throtl_dispatch_work_fn() when the timer expires.But in the current process, if bio is throttled. The BIO_THROTTLED will be set to bio after timer start. If the bio has been completed, it may cause use-after-free blow. BUG: KASAN: use-after-free in blk_throtl_bio+0x12f0/0x2c70 Read of size 2 at addr ffff88801b8902d4 by task fio/26380 dump_stack+0x9b/0xce print_address_description.constprop.6+0x3e/0x60 kasan_report.cold.9+0x22/0x3a blk_throtl_bio+0x12f0/0x2c70 submit_bio_checks+0x701/0x1550 submit_bio_noacct+0x83/0xc80 submit_bio+0xa7/0x330 mpage_readahead+0x380/0x500 read_pages+0x1c1/0xbf0 page_cache_ra_unbounded+0x471/0x6f0 do_page_cache_ra+0xda/0x110 ondemand_readahead+0x442/0xae0 page_cache_async_ra+0x210/0x300 generic_file_buffered_read+0x4d9/0x2130 generic_file_read_iter+0x315/0x490 blkdev_read_iter+0x113/0x1b0 aio_read+0x2ad/0x450 io_submit_one+0xc8e/0x1d60 __se_sys_io_submit+0x125/0x350 do_syscall_64+0x2d/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Allocated by task 26380: kasan_save_stack+0x19/0x40 __kasan_kmalloc.constprop.2+0xc1/0xd0 kmem_cache_alloc+0x146/0x440 mempool_alloc+0x125/0x2f0 bio_alloc_bioset+0x353/0x590 mpage_alloc+0x3b/0x240 do_mpage_readpage+0xddf/0x1ef0 mpage_readahead+0x264/0x500 read_pages+0x1c1/0xbf0 page_cache_ra_unbounded+0x471/0x6f0 do_page_cache_ra+0xda/0x110 ondemand_readahead+0x442/0xae0 page_cache_async_ra+0x210/0x300 generic_file_buffered_read+0x4d9/0x2130 generic_file_read_iter+0x315/0x490 blkdev_read_iter+0x113/0x1b0 aio_read+0x2ad/0x450 io_submit_one+0xc8e/0x1d60 __se_sys_io_submit+0x125/0x350 do_syscall_64+0x2d/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 0: kasan_save_stack+0x19/0x40 kasan_set_track+0x1c/0x30 kasan_set_free_info+0x1b/0x30 __kasan_slab_free+0x111/0x160 kmem_cache_free+0x94/0x460 mempool_free+0xd6/0x320 bio_free+0xe0/0x130 bio_put+0xab/0xe0 bio_endio+0x3a6/0x5d0 blk_update_request+0x590/0x1370 scsi_end_request+0x7d/0x400 scsi_io_completion+0x1aa/0xe50 scsi_softirq_done+0x11b/0x240 blk_mq_complete_request+0xd4/0x120 scsi_mq_done+0xf0/0x200 virtscsi_vq_done+0xbc/0x150 vring_interrupt+0x179/0x390 __handle_irq_event_percpu+0xf7/0x490 handle_irq_event_percpu+0x7b/0x160 handle_irq_event+0xcc/0x170 handle_edge_irq+0x215/0xb20 common_interrupt+0x60/0x120 asm_common_interrupt+0x1e/0x40 Fix this by move BIO_THROTTLED set into the queue_lock.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-27 18:16 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2a0f61e6ecd08d260054bde4b096ff207ce5350f , < 24ba80efaf6e772f6132465fad08e20fb4767da7 (git)
Affected: 2a0f61e6ecd08d260054bde4b096ff207ce5350f , < 047ea38d41d90d748bca812a43339632f52ba715 (git)
Affected: 2a0f61e6ecd08d260054bde4b096ff207ce5350f , < 0cfc8a0fb07cde61915e4a77c4794c47de3114a4 (git)
Affected: 2a0f61e6ecd08d260054bde4b096ff207ce5350f , < 935fa666534d7b7185e8c6b0191cd06281be4290 (git)
Affected: 2a0f61e6ecd08d260054bde4b096ff207ce5350f , < 5a011f889b4832aa80c2a872a5aade5c48d2756f (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.11
Unaffected: 0 , < 3.11 (semver)
Unaffected: 5.10.248 , ≤ 5.10.* (semver)
Unaffected: 5.15.198 , ≤ 5.15.* (semver)
Unaffected: 5.17.14 , ≤ 5.17.* (semver)
Unaffected: 5.18.3 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49465",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T18:16:02.824581Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:22:32.723Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/blk-throttle.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "24ba80efaf6e772f6132465fad08e20fb4767da7",
              "status": "affected",
              "version": "2a0f61e6ecd08d260054bde4b096ff207ce5350f",
              "versionType": "git"
            },
            {
              "lessThan": "047ea38d41d90d748bca812a43339632f52ba715",
              "status": "affected",
              "version": "2a0f61e6ecd08d260054bde4b096ff207ce5350f",
              "versionType": "git"
            },
            {
              "lessThan": "0cfc8a0fb07cde61915e4a77c4794c47de3114a4",
              "status": "affected",
              "version": "2a0f61e6ecd08d260054bde4b096ff207ce5350f",
              "versionType": "git"
            },
            {
              "lessThan": "935fa666534d7b7185e8c6b0191cd06281be4290",
              "status": "affected",
              "version": "2a0f61e6ecd08d260054bde4b096ff207ce5350f",
              "versionType": "git"
            },
            {
              "lessThan": "5a011f889b4832aa80c2a872a5aade5c48d2756f",
              "status": "affected",
              "version": "2a0f61e6ecd08d260054bde4b096ff207ce5350f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/blk-throttle.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.11"
            },
            {
              "lessThan": "3.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.248",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.198",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.14",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.3",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-throttle: Set BIO_THROTTLED when bio has been throttled\n\n1.In current process, all bio will set the BIO_THROTTLED flag\nafter __blk_throtl_bio().\n\n2.If bio needs to be throttled, it will start the timer and\nstop submit bio directly. Bio will submit in\nblk_throtl_dispatch_work_fn() when the timer expires.But in\nthe current process, if bio is throttled. The BIO_THROTTLED\nwill be set to bio after timer start. If the bio has been\ncompleted, it may cause use-after-free blow.\n\nBUG: KASAN: use-after-free in blk_throtl_bio+0x12f0/0x2c70\nRead of size 2 at addr ffff88801b8902d4 by task fio/26380\n\n dump_stack+0x9b/0xce\n print_address_description.constprop.6+0x3e/0x60\n kasan_report.cold.9+0x22/0x3a\n blk_throtl_bio+0x12f0/0x2c70\n submit_bio_checks+0x701/0x1550\n submit_bio_noacct+0x83/0xc80\n submit_bio+0xa7/0x330\n mpage_readahead+0x380/0x500\n read_pages+0x1c1/0xbf0\n page_cache_ra_unbounded+0x471/0x6f0\n do_page_cache_ra+0xda/0x110\n ondemand_readahead+0x442/0xae0\n page_cache_async_ra+0x210/0x300\n generic_file_buffered_read+0x4d9/0x2130\n generic_file_read_iter+0x315/0x490\n blkdev_read_iter+0x113/0x1b0\n aio_read+0x2ad/0x450\n io_submit_one+0xc8e/0x1d60\n __se_sys_io_submit+0x125/0x350\n do_syscall_64+0x2d/0x40\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nAllocated by task 26380:\n kasan_save_stack+0x19/0x40\n __kasan_kmalloc.constprop.2+0xc1/0xd0\n kmem_cache_alloc+0x146/0x440\n mempool_alloc+0x125/0x2f0\n bio_alloc_bioset+0x353/0x590\n mpage_alloc+0x3b/0x240\n do_mpage_readpage+0xddf/0x1ef0\n mpage_readahead+0x264/0x500\n read_pages+0x1c1/0xbf0\n page_cache_ra_unbounded+0x471/0x6f0\n do_page_cache_ra+0xda/0x110\n ondemand_readahead+0x442/0xae0\n page_cache_async_ra+0x210/0x300\n generic_file_buffered_read+0x4d9/0x2130\n generic_file_read_iter+0x315/0x490\n blkdev_read_iter+0x113/0x1b0\n aio_read+0x2ad/0x450\n io_submit_one+0xc8e/0x1d60\n __se_sys_io_submit+0x125/0x350\n do_syscall_64+0x2d/0x40\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nFreed by task 0:\n kasan_save_stack+0x19/0x40\n kasan_set_track+0x1c/0x30\n kasan_set_free_info+0x1b/0x30\n __kasan_slab_free+0x111/0x160\n kmem_cache_free+0x94/0x460\n mempool_free+0xd6/0x320\n bio_free+0xe0/0x130\n bio_put+0xab/0xe0\n bio_endio+0x3a6/0x5d0\n blk_update_request+0x590/0x1370\n scsi_end_request+0x7d/0x400\n scsi_io_completion+0x1aa/0xe50\n scsi_softirq_done+0x11b/0x240\n blk_mq_complete_request+0xd4/0x120\n scsi_mq_done+0xf0/0x200\n virtscsi_vq_done+0xbc/0x150\n vring_interrupt+0x179/0x390\n __handle_irq_event_percpu+0xf7/0x490\n handle_irq_event_percpu+0x7b/0x160\n handle_irq_event+0xcc/0x170\n handle_edge_irq+0x215/0xb20\n common_interrupt+0x60/0x120\n asm_common_interrupt+0x1e/0x40\n\nFix this by move BIO_THROTTLED set into the queue_lock."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached via local block I/O syscalls (e.g. io_submit/read \u2192 submit_bio \u2192 blk_throtl_bio); it is not a network-protocol handler.\nAC:L - An attacker who can submit I/O under a throttle limit creates both the queued bio and concurrent load that expands the unlock-to-flag race (as shown by the real-world fio/KASAN report), so success does not depend on conditions beyond attacker influence.\nPR:L - Any unprivileged local user performing ordinary I/O in a cgroup with io.max/blkio throttle rules (common in containers), or who can set io.max in a delegated sub-hierarchy, can reach the buggy code without real root.\nUI:N - Exploitation requires only the attacker\u2019s own I/O submissions; no separate victim action is needed.\nS:U - This is a standard in-kernel UAF/privilege-escalation impact within the host kernel\u2019s security authority, with no VM/IOMMU/sandbox boundary crossed.\nC:H - Use-after-free on a bio object enables heap reuse and arbitrary read primitives per UAF exploitation guidance.\nI:H - bio_set_flag performs a write to freed bio-\u003ebi_flags, yielding a UAF write that can corrupt reallocated heap objects and enable control-flow hijacking.\nA:H - The UAF can cause kernel oops/panic (as demonstrated by KASAN) and therefore fully impacts availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:55:17.125Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/24ba80efaf6e772f6132465fad08e20fb4767da7"
        },
        {
          "url": "https://git.kernel.org/stable/c/047ea38d41d90d748bca812a43339632f52ba715"
        },
        {
          "url": "https://git.kernel.org/stable/c/0cfc8a0fb07cde61915e4a77c4794c47de3114a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/935fa666534d7b7185e8c6b0191cd06281be4290"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a011f889b4832aa80c2a872a5aade5c48d2756f"
        }
      ],
      "title": "blk-throttle: Set BIO_THROTTLED when bio has been throttled",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49465",
    "datePublished": "2025-02-26T02:13:10.975Z",
    "dateReserved": "2025-02-26T02:08:31.577Z",
    "dateUpdated": "2026-08-05T08:55:17.125Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49465",
      "date": "2026-09-16",
      "epss": "0.00288",
      "percentile": "0.21484"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-24T14:35:11.000Z",
      "cve": "CVE-2022-49465",
      "id": "msrc_CVE-2022-49465",
      "initial_release_date": "2025-02-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "blk-throttle: Set BIO_THROTTLED when bio has been throttled",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2022-49465.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49465\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:22.787\",\"lastModified\":\"2026-06-17T05:18:07.803\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblk-throttle: Set BIO_THROTTLED when bio has been throttled\\n\\n1.In current process, all bio will set the BIO_THROTTLED flag\\nafter __blk_throtl_bio().\\n\\n2.If bio needs to be throttled, it will start the timer and\\nstop submit bio directly. Bio will submit in\\nblk_throtl_dispatch_work_fn() when the timer expires.But in\\nthe current process, if bio is throttled. The BIO_THROTTLED\\nwill be set to bio after timer start. If the bio has been\\ncompleted, it may cause use-after-free blow.\\n\\nBUG: KASAN: use-after-free in blk_throtl_bio+0x12f0/0x2c70\\nRead of size 2 at addr ffff88801b8902d4 by task fio/26380\\n\\n dump_stack+0x9b/0xce\\n print_address_description.constprop.6+0x3e/0x60\\n kasan_report.cold.9+0x22/0x3a\\n blk_throtl_bio+0x12f0/0x2c70\\n submit_bio_checks+0x701/0x1550\\n submit_bio_noacct+0x83/0xc80\\n submit_bio+0xa7/0x330\\n mpage_readahead+0x380/0x500\\n read_pages+0x1c1/0xbf0\\n page_cache_ra_unbounded+0x471/0x6f0\\n do_page_cache_ra+0xda/0x110\\n ondemand_readahead+0x442/0xae0\\n page_cache_async_ra+0x210/0x300\\n generic_file_buffered_read+0x4d9/0x2130\\n generic_file_read_iter+0x315/0x490\\n blkdev_read_iter+0x113/0x1b0\\n aio_read+0x2ad/0x450\\n io_submit_one+0xc8e/0x1d60\\n __se_sys_io_submit+0x125/0x350\\n do_syscall_64+0x2d/0x40\\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\\n\\nAllocated by task 26380:\\n kasan_save_stack+0x19/0x40\\n __kasan_kmalloc.constprop.2+0xc1/0xd0\\n kmem_cache_alloc+0x146/0x440\\n mempool_alloc+0x125/0x2f0\\n bio_alloc_bioset+0x353/0x590\\n mpage_alloc+0x3b/0x240\\n do_mpage_readpage+0xddf/0x1ef0\\n mpage_readahead+0x264/0x500\\n read_pages+0x1c1/0xbf0\\n page_cache_ra_unbounded+0x471/0x6f0\\n do_page_cache_ra+0xda/0x110\\n ondemand_readahead+0x442/0xae0\\n page_cache_async_ra+0x210/0x300\\n generic_file_buffered_read+0x4d9/0x2130\\n generic_file_read_iter+0x315/0x490\\n blkdev_read_iter+0x113/0x1b0\\n aio_read+0x2ad/0x450\\n io_submit_one+0xc8e/0x1d60\\n __se_sys_io_submit+0x125/0x350\\n do_syscall_64+0x2d/0x40\\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\\n\\nFreed by task 0:\\n kasan_save_stack+0x19/0x40\\n kasan_set_track+0x1c/0x30\\n kasan_set_free_info+0x1b/0x30\\n __kasan_slab_free+0x111/0x160\\n kmem_cache_free+0x94/0x460\\n mempool_free+0xd6/0x320\\n bio_free+0xe0/0x130\\n bio_put+0xab/0xe0\\n bio_endio+0x3a6/0x5d0\\n blk_update_request+0x590/0x1370\\n scsi_end_request+0x7d/0x400\\n scsi_io_completion+0x1aa/0xe50\\n scsi_softirq_done+0x11b/0x240\\n blk_mq_complete_request+0xd4/0x120\\n scsi_mq_done+0xf0/0x200\\n virtscsi_vq_done+0xbc/0x150\\n vring_interrupt+0x179/0x390\\n __handle_irq_event_percpu+0xf7/0x490\\n handle_irq_event_percpu+0x7b/0x160\\n handle_irq_event+0xcc/0x170\\n handle_edge_irq+0x215/0xb20\\n common_interrupt+0x60/0x120\\n asm_common_interrupt+0x1e/0x40\\n\\nFix this by move BIO_THROTTLED set into the queue_lock.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: blk-throttle: Establecer BIO_THROTTLED cuando bio ha sido limitado 1. En el proceso actual, todos los bio establecer\u00e1n el indicador BIO_THROTTLED despu\u00e9s de __blk_throtl_bio(). 2. Si es necesario limitar bio, iniciar\u00e1 el temporizador y detendr\u00e1 el env\u00edo de bio directamente. Bio se enviar\u00e1 en blk_throtl_dispatch_work_fn() cuando expire el temporizador. Pero en el proceso actual, si bio est\u00e1 limitado. BIO_THROTTLED se establecer\u00e1 en bio despu\u00e9s del inicio del temporizador. Si el bio se ha completado, puede causar una explosi\u00f3n de use-after-free. ERROR: KASAN: use-after-free in blk_throtl_bio+0x12f0/0x2c70 Read of size 2 at addr ffff88801b8902d4 by task fio/26380 dump_stack+0x9b/0xce print_address_description.constprop.6+0x3e/0x60 kasan_report.cold.9+0x22/0x3a blk_throtl_bio+0x12f0/0x2c70 submit_bio_checks+0x701/0x1550 submit_bio_noacct+0x83/0xc80 submit_bio+0xa7/0x330 mpage_readahead+0x380/0x500 read_pages+0x1c1/0xbf0 page_cache_ra_unbounded+0x471/0x6f0 do_page_cache_ra+0xda/0x110 ondemand_readahead+0x442/0xae0 page_cache_async_ra+0x210/0x300 generic_file_buffered_read+0x4d9/0x2130 generic_file_read_iter+0x315/0x490 blkdev_read_iter+0x113/0x1b0 aio_read+0x2ad/0x450 io_submit_one+0xc8e/0x1d60 __se_sys_io_submit+0x125/0x350 do_syscall_64+0x2d/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Allocated by task 26380: kasan_save_stack+0x19/0x40 __kasan_kmalloc.constprop.2+0xc1/0xd0 kmem_cache_alloc+0x146/0x440 mempool_alloc+0x125/0x2f0 bio_alloc_bioset+0x353/0x590 mpage_alloc+0x3b/0x240 do_mpage_readpage+0xddf/0x1ef0 mpage_readahead+0x264/0x500 read_pages+0x1c1/0xbf0 page_cache_ra_unbounded+0x471/0x6f0 do_page_cache_ra+0xda/0x110 ondemand_readahead+0x442/0xae0 page_cache_async_ra+0x210/0x300 generic_file_buffered_read+0x4d9/0x2130 generic_file_read_iter+0x315/0x490 blkdev_read_iter+0x113/0x1b0 aio_read+0x2ad/0x450 io_submit_one+0xc8e/0x1d60 __se_sys_io_submit+0x125/0x350 do_syscall_64+0x2d/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 0: kasan_save_stack+0x19/0x40 kasan_set_track+0x1c/0x30 kasan_set_free_info+0x1b/0x30 __kasan_slab_free+0x111/0x160 kmem_cache_free+0x94/0x460 mempool_free+0xd6/0x320 bio_free+0xe0/0x130 bio_put+0xab/0xe0 bio_endio+0x3a6/0x5d0 blk_update_request+0x590/0x1370 scsi_end_request+0x7d/0x400 scsi_io_completion+0x1aa/0xe50 scsi_softirq_done+0x11b/0x240 blk_mq_complete_request+0xd4/0x120 scsi_mq_done+0xf0/0x200 virtscsi_vq_done+0xbc/0x150 vring_interrupt+0x179/0x390 __handle_irq_event_percpu+0xf7/0x490 handle_irq_event_percpu+0x7b/0x160 handle_irq_event+0xcc/0x170 handle_edge_irq+0x215/0xb20 common_interrupt+0x60/0x120 asm_common_interrupt+0x1e/0x40 Fix this by move BIO_THROTTLED set into the queue_lock. \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"block/blk-throttle.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2a0f61e6ecd08d260054bde4b096ff207ce5350f\",\"lessThan\":\"24ba80efaf6e772f6132465fad08e20fb4767da7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2a0f61e6ecd08d260054bde4b096ff207ce5350f\",\"lessThan\":\"047ea38d41d90d748bca812a43339632f52ba715\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2a0f61e6ecd08d260054bde4b096ff207ce5350f\",\"lessThan\":\"0cfc8a0fb07cde61915e4a77c4794c47de3114a4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2a0f61e6ecd08d260054bde4b096ff207ce5350f\",\"lessThan\":\"935fa666534d7b7185e8c6b0191cd06281be4290\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2a0f61e6ecd08d260054bde4b096ff207ce5350f\",\"lessThan\":\"5a011f889b4832aa80c2a872a5aade5c48d2756f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"block/blk-throttle.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.248\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.198\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17.14\",\"lessThanOrEqual\":\"5.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18.3\",\"lessThanOrEqual\":\"5.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-27T18:16:02.824581Z\",\"id\":\"CVE-2022-49465\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.10.248\",\"matchCriteriaId\":\"B42E4BD5-25E8-46E1-9C5E-FEED77EA97B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.198\",\"matchCriteriaId\":\"82159CAA-B6BA-43C6-85D8-65BDBC175A7E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.17.14\",\"matchCriteriaId\":\"15E2DD33-2255-4B76-9C15-04FF8CBAB252\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"5.18.3\",\"matchCriteriaId\":\"8E122216-2E9E-4B3E-B7B8-D575A45BA3C2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/047ea38d41d90d748bca812a43339632f52ba715\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0cfc8a0fb07cde61915e4a77c4794c47de3114a4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/24ba80efaf6e772f6132465fad08e20fb4767da7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5a011f889b4832aa80c2a872a5aade5c48d2756f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/935fa666534d7b7185e8c6b0191cd06281be4290\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T21:08:25+00:00",
      "cve": "CVE-2022-49465",
      "id": "CVE-2022-49465",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "166",
      "product_status:known_affected": "112",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: blk-throttle: Set BIO_THROTTLED when bio has been throttled",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49465.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-02T02:04:13Z",
      "cve": "CVE-2022-49465",
      "id": "CVE-2022-49465",
      "initial_release_date": "2025-02-27T03:06:26Z",
      "product_status:known_affected": "448",
      "product_status:known_not_affected": "178",
      "product_status:recommended": "398",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49465",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49465.json",
      "version": "64"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-49465\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-27T18:16:02.824581Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-27T18:16:04.138Z\"}}], \"cna\": {\"title\": \"blk-throttle: Set BIO_THROTTLED when bio has been throttled\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable path is reached via local block I/O syscalls (e.g. io_submit/read \\u2192 submit_bio \\u2192 blk_throtl_bio); it is not a network-protocol handler.\\nAC:L - An attacker who can submit I/O under a throttle limit creates both the queued bio and concurrent load that expands the unlock-to-flag race (as shown by the real-world fio/KASAN report), so success does not depend on conditions beyond attacker influence.\\nPR:L - Any unprivileged local user performing ordinary I/O in a cgroup with io.max/blkio throttle rules (common in containers), or who can set io.max in a delegated sub-hierarchy, can reach the buggy code without real root.\\nUI:N - Exploitation requires only the attacker\\u2019s own I/O submissions; no separate victim action is needed.\\nS:U - This is a standard in-kernel UAF/privilege-escalation impact within the host kernel\\u2019s security authority, with no VM/IOMMU/sandbox boundary crossed.\\nC:H - Use-after-free on a bio object enables heap reuse and arbitrary read primitives per UAF exploitation guidance.\\nI:H - bio_set_flag performs a write to freed bio-\u003ebi_flags, yielding a UAF write that can corrupt reallocated heap objects and enable control-flow hijacking.\\nA:H - The UAF can cause kernel oops/panic (as demonstrated by KASAN) and therefore fully impacts availability.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2a0f61e6ecd08d260054bde4b096ff207ce5350f\", \"lessThan\": \"24ba80efaf6e772f6132465fad08e20fb4767da7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2a0f61e6ecd08d260054bde4b096ff207ce5350f\", \"lessThan\": \"047ea38d41d90d748bca812a43339632f52ba715\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2a0f61e6ecd08d260054bde4b096ff207ce5350f\", \"lessThan\": \"0cfc8a0fb07cde61915e4a77c4794c47de3114a4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2a0f61e6ecd08d260054bde4b096ff207ce5350f\", \"lessThan\": \"935fa666534d7b7185e8c6b0191cd06281be4290\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2a0f61e6ecd08d260054bde4b096ff207ce5350f\", \"lessThan\": \"5a011f889b4832aa80c2a872a5aade5c48d2756f\", \"versionType\": \"git\"}], \"programFiles\": [\"block/blk-throttle.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.248\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.198\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.17.*\"}, {\"status\": \"unaffected\", \"version\": \"5.18.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.18.*\"}, {\"status\": \"unaffected\", \"version\": \"5.19\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"block/blk-throttle.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/24ba80efaf6e772f6132465fad08e20fb4767da7\"}, {\"url\": \"https://git.kernel.org/stable/c/047ea38d41d90d748bca812a43339632f52ba715\"}, {\"url\": \"https://git.kernel.org/stable/c/0cfc8a0fb07cde61915e4a77c4794c47de3114a4\"}, {\"url\": \"https://git.kernel.org/stable/c/935fa666534d7b7185e8c6b0191cd06281be4290\"}, {\"url\": \"https://git.kernel.org/stable/c/5a011f889b4832aa80c2a872a5aade5c48d2756f\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblk-throttle: Set BIO_THROTTLED when bio has been throttled\\n\\n1.In current process, all bio will set the BIO_THROTTLED flag\\nafter __blk_throtl_bio().\\n\\n2.If bio needs to be throttled, it will start the timer and\\nstop submit bio directly. Bio will submit in\\nblk_throtl_dispatch_work_fn() when the timer expires.But in\\nthe current process, if bio is throttled. The BIO_THROTTLED\\nwill be set to bio after timer start. If the bio has been\\ncompleted, it may cause use-after-free blow.\\n\\nBUG: KASAN: use-after-free in blk_throtl_bio+0x12f0/0x2c70\\nRead of size 2 at addr ffff88801b8902d4 by task fio/26380\\n\\n dump_stack+0x9b/0xce\\n print_address_description.constprop.6+0x3e/0x60\\n kasan_report.cold.9+0x22/0x3a\\n blk_throtl_bio+0x12f0/0x2c70\\n submit_bio_checks+0x701/0x1550\\n submit_bio_noacct+0x83/0xc80\\n submit_bio+0xa7/0x330\\n mpage_readahead+0x380/0x500\\n read_pages+0x1c1/0xbf0\\n page_cache_ra_unbounded+0x471/0x6f0\\n do_page_cache_ra+0xda/0x110\\n ondemand_readahead+0x442/0xae0\\n page_cache_async_ra+0x210/0x300\\n generic_file_buffered_read+0x4d9/0x2130\\n generic_file_read_iter+0x315/0x490\\n blkdev_read_iter+0x113/0x1b0\\n aio_read+0x2ad/0x450\\n io_submit_one+0xc8e/0x1d60\\n __se_sys_io_submit+0x125/0x350\\n do_syscall_64+0x2d/0x40\\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\\n\\nAllocated by task 26380:\\n kasan_save_stack+0x19/0x40\\n __kasan_kmalloc.constprop.2+0xc1/0xd0\\n kmem_cache_alloc+0x146/0x440\\n mempool_alloc+0x125/0x2f0\\n bio_alloc_bioset+0x353/0x590\\n mpage_alloc+0x3b/0x240\\n do_mpage_readpage+0xddf/0x1ef0\\n mpage_readahead+0x264/0x500\\n read_pages+0x1c1/0xbf0\\n page_cache_ra_unbounded+0x471/0x6f0\\n do_page_cache_ra+0xda/0x110\\n ondemand_readahead+0x442/0xae0\\n page_cache_async_ra+0x210/0x300\\n generic_file_buffered_read+0x4d9/0x2130\\n generic_file_read_iter+0x315/0x490\\n blkdev_read_iter+0x113/0x1b0\\n aio_read+0x2ad/0x450\\n io_submit_one+0xc8e/0x1d60\\n __se_sys_io_submit+0x125/0x350\\n do_syscall_64+0x2d/0x40\\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\\n\\nFreed by task 0:\\n kasan_save_stack+0x19/0x40\\n kasan_set_track+0x1c/0x30\\n kasan_set_free_info+0x1b/0x30\\n __kasan_slab_free+0x111/0x160\\n kmem_cache_free+0x94/0x460\\n mempool_free+0xd6/0x320\\n bio_free+0xe0/0x130\\n bio_put+0xab/0xe0\\n bio_endio+0x3a6/0x5d0\\n blk_update_request+0x590/0x1370\\n scsi_end_request+0x7d/0x400\\n scsi_io_completion+0x1aa/0xe50\\n scsi_softirq_done+0x11b/0x240\\n blk_mq_complete_request+0xd4/0x120\\n scsi_mq_done+0xf0/0x200\\n virtscsi_vq_done+0xbc/0x150\\n vring_interrupt+0x179/0x390\\n __handle_irq_event_percpu+0xf7/0x490\\n handle_irq_event_percpu+0x7b/0x160\\n handle_irq_event+0xcc/0x170\\n handle_edge_irq+0x215/0xb20\\n common_interrupt+0x60/0x120\\n asm_common_interrupt+0x1e/0x40\\n\\nFix this by move BIO_THROTTLED set into the queue_lock.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.248\", \"versionStartIncluding\": \"3.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.198\", \"versionStartIncluding\": \"3.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17.14\", \"versionStartIncluding\": \"3.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.18.3\", \"versionStartIncluding\": \"3.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.19\", \"versionStartIncluding\": \"3.11\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:55:17.125Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-49465\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:55:17.125Z\", \"dateReserved\": \"2025-02-26T02:08:31.577Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-26T02:13:10.975Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.