GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49266 (GCVE-0-2022-49266)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:56 – Updated: 2026-05-23 15:21
VLAI
Title
block: fix rq-qos breakage from skipping rq_qos_done_bio()
Summary
In the Linux kernel, the following vulnerability has been resolved: block: fix rq-qos breakage from skipping rq_qos_done_bio() a647a524a467 ("block: don't call rq_qos_ops->done_bio if the bio isn't tracked") made bio_endio() skip rq_qos_done_bio() if BIO_TRACKED is not set. While this fixed a potential oops, it also broke blk-iocost by skipping the done_bio callback for merged bios. Before, whether a bio goes through rq_qos_throttle() or rq_qos_merge(), rq_qos_done_bio() would be called on the bio on completion with BIO_TRACKED distinguishing the former from the latter. rq_qos_done_bio() is not called for bios which wenth through rq_qos_merge(). This royally confuses blk-iocost as the merged bios never finish and are considered perpetually in-flight. One reliably reproducible failure mode is an intermediate cgroup geting stuck active preventing its children from being activated due to the leaf-only rule, leading to loss of control. The following is from resctl-bench protection scenario which emulates isolating a web server like workload from a memory bomb run on an iocost configuration which should yield a reasonable level of protection. # cat /sys/block/nvme2n1/device/model Samsung SSD 970 PRO 512GB # cat /sys/fs/cgroup/io.cost.model 259:0 ctrl=user model=linear rbps=834913556 rseqiops=93622 rrandiops=102913 wbps=618985353 wseqiops=72325 wrandiops=71025 # cat /sys/fs/cgroup/io.cost.qos 259:0 enable=1 ctrl=user rpct=95.00 rlat=18776 wpct=95.00 wlat=8897 min=60.00 max=100.00 # resctl-bench -m 29.6G -r out.json run protection::scenario=mem-hog,loops=1 ... Memory Hog Summary ================== IO Latency: R p50=242u:336u/2.5m p90=794u:1.4m/7.5m p99=2.7m:8.0m/62.5m max=8.0m:36.4m/350m W p50=221u:323u/1.5m p90=709u:1.2m/5.5m p99=1.5m:2.5m/9.5m max=6.9m:35.9m/350m Isolation and Request Latency Impact Distributions: min p01 p05 p10 p25 p50 p75 p90 p95 p99 max mean stdev isol% 15.90 15.90 15.90 40.05 57.24 59.07 60.01 74.63 74.63 90.35 90.35 58.12 15.82 lat-imp% 0 0 0 0 0 4.55 14.68 15.54 233.5 548.1 548.1 53.88 143.6 Result: isol=58.12:15.82% lat_imp=53.88%:143.6 work_csv=100.0% missing=3.96% The isolation result of 58.12% is close to what this device would show without any IO control. Fix it by introducing a new flag BIO_QOS_MERGED to mark merged bios and calling rq_qos_done_bio() on them too. For consistency and clarity, rename BIO_TRACKED to BIO_QOS_THROTTLED. The flag checks are moved into rq_qos_done_bio() so that it's next to the code paths that set the flags. With the patch applied, the above same benchmark shows: # resctl-bench -m 29.6G -r out.json run protection::scenario=mem-hog,loops=1 ... Memory Hog Summary ================== IO Latency: R p50=123u:84.4u/985u p90=322u:256u/2.5m p99=1.6m:1.4m/9.5m max=11.1m:36.0m/350m W p50=429u:274u/995u p90=1.7m:1.3m/4.5m p99=3.4m:2.7m/11.5m max=7.9m:5.9m/26.5m Isolation and Request Latency Impact Distributions: min p01 p05 p10 p25 p50 p75 p90 p95 p99 max mean stdev isol% 84.91 84.91 89.51 90.73 92.31 94.49 96.36 98.04 98.71 100.0 100.0 94.42 2.81 lat-imp% 0 0 0 0 0 2.81 5.73 11.11 13.92 17.53 22.61 4.10 4.68 Result: isol=94.42:2.81% lat_imp=4.10%:4.68 work_csv=58.34% missing=0%
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a647a524a46736786c95cdb553a070322ca096e3 , < af9452dfdba4bf7359ef7645eee2d243a1df0649 (git)
Affected: a647a524a46736786c95cdb553a070322ca096e3 , < dbd20bb904ad5731aaca8d009367a930d6ada111 (git)
Affected: a647a524a46736786c95cdb553a070322ca096e3 , < 09737db4c891eba25e6f6383a7c38afd4acc883f (git)
Affected: a647a524a46736786c95cdb553a070322ca096e3 , < aa1b46dcdc7baaf5fec0be25782ef24b26aa209e (git)
Affected: db60edbfff332a6a5477c367af8125f034570989 (git)
Affected: 004b8f8a691205a93d9e80d98b786b2b97424d6e (git)
Affected: 5.10.241 , < 5.11 (semver)
Affected: 5.14.11 , < 5.15 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.54 , ≤ 5.15.* (semver)
Unaffected: 5.16.19 , ≤ 5.16.* (semver)
Unaffected: 5.17.2 , ≤ 5.17.* (semver)
Unaffected: 5.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/bio.c",
            "block/blk-iolatency.c",
            "block/blk-rq-qos.h",
            "include/linux/blk_types.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "af9452dfdba4bf7359ef7645eee2d243a1df0649",
              "status": "affected",
              "version": "a647a524a46736786c95cdb553a070322ca096e3",
              "versionType": "git"
            },
            {
              "lessThan": "dbd20bb904ad5731aaca8d009367a930d6ada111",
              "status": "affected",
              "version": "a647a524a46736786c95cdb553a070322ca096e3",
              "versionType": "git"
            },
            {
              "lessThan": "09737db4c891eba25e6f6383a7c38afd4acc883f",
              "status": "affected",
              "version": "a647a524a46736786c95cdb553a070322ca096e3",
              "versionType": "git"
            },
            {
              "lessThan": "aa1b46dcdc7baaf5fec0be25782ef24b26aa209e",
              "status": "affected",
              "version": "a647a524a46736786c95cdb553a070322ca096e3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "db60edbfff332a6a5477c367af8125f034570989",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "004b8f8a691205a93d9e80d98b786b2b97424d6e",
              "versionType": "git"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15",
              "status": "affected",
              "version": "5.14.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/bio.c",
            "block/blk-iolatency.c",
            "block/blk-rq-qos.h",
            "include/linux/blk_types.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.54",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.19",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.241",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.14.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: fix rq-qos breakage from skipping rq_qos_done_bio()\n\na647a524a467 (\"block: don\u0027t call rq_qos_ops-\u003edone_bio if the bio isn\u0027t\ntracked\") made bio_endio() skip rq_qos_done_bio() if BIO_TRACKED is not set.\nWhile this fixed a potential oops, it also broke blk-iocost by skipping the\ndone_bio callback for merged bios.\n\nBefore, whether a bio goes through rq_qos_throttle() or rq_qos_merge(),\nrq_qos_done_bio() would be called on the bio on completion with BIO_TRACKED\ndistinguishing the former from the latter. rq_qos_done_bio() is not called\nfor bios which wenth through rq_qos_merge(). This royally confuses\nblk-iocost as the merged bios never finish and are considered perpetually\nin-flight.\n\nOne reliably reproducible failure mode is an intermediate cgroup geting\nstuck active preventing its children from being activated due to the\nleaf-only rule, leading to loss of control. The following is from\nresctl-bench protection scenario which emulates isolating a web server like\nworkload from a memory bomb run on an iocost configuration which should\nyield a reasonable level of protection.\n\n  # cat /sys/block/nvme2n1/device/model\n  Samsung SSD 970 PRO 512GB\n  # cat /sys/fs/cgroup/io.cost.model\n  259:0 ctrl=user model=linear rbps=834913556 rseqiops=93622 rrandiops=102913 wbps=618985353 wseqiops=72325 wrandiops=71025\n  # cat /sys/fs/cgroup/io.cost.qos\n  259:0 enable=1 ctrl=user rpct=95.00 rlat=18776 wpct=95.00 wlat=8897 min=60.00 max=100.00\n  # resctl-bench -m 29.6G -r out.json run protection::scenario=mem-hog,loops=1\n  ...\n  Memory Hog Summary\n  ==================\n\n  IO Latency: R p50=242u:336u/2.5m p90=794u:1.4m/7.5m p99=2.7m:8.0m/62.5m max=8.0m:36.4m/350m\n              W p50=221u:323u/1.5m p90=709u:1.2m/5.5m p99=1.5m:2.5m/9.5m max=6.9m:35.9m/350m\n\n  Isolation and Request Latency Impact Distributions:\n\n                min   p01   p05   p10   p25   p50   p75   p90   p95   p99   max  mean stdev\n  isol%       15.90 15.90 15.90 40.05 57.24 59.07 60.01 74.63 74.63 90.35 90.35 58.12 15.82\n  lat-imp%        0     0     0     0     0  4.55 14.68 15.54 233.5 548.1 548.1 53.88 143.6\n\n  Result: isol=58.12:15.82% lat_imp=53.88%:143.6 work_csv=100.0% missing=3.96%\n\nThe isolation result of 58.12% is close to what this device would show\nwithout any IO control.\n\nFix it by introducing a new flag BIO_QOS_MERGED to mark merged bios and\ncalling rq_qos_done_bio() on them too. For consistency and clarity, rename\nBIO_TRACKED to BIO_QOS_THROTTLED. The flag checks are moved into\nrq_qos_done_bio() so that it\u0027s next to the code paths that set the flags.\n\nWith the patch applied, the above same benchmark shows:\n\n  # resctl-bench -m 29.6G -r out.json run protection::scenario=mem-hog,loops=1\n  ...\n  Memory Hog Summary\n  ==================\n\n  IO Latency: R p50=123u:84.4u/985u p90=322u:256u/2.5m p99=1.6m:1.4m/9.5m max=11.1m:36.0m/350m\n              W p50=429u:274u/995u p90=1.7m:1.3m/4.5m p99=3.4m:2.7m/11.5m max=7.9m:5.9m/26.5m\n\n  Isolation and Request Latency Impact Distributions:\n\n                min   p01   p05   p10   p25   p50   p75   p90   p95   p99   max  mean stdev\n  isol%       84.91 84.91 89.51 90.73 92.31 94.49 96.36 98.04 98.71 100.0 100.0 94.42  2.81\n  lat-imp%        0     0     0     0     0  2.81  5.73 11.11 13.92 17.53 22.61  4.10  4.68\n\n  Result: isol=94.42:2.81% lat_imp=4.10%:4.68 work_csv=58.34% missing=0%"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:21:48.745Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/af9452dfdba4bf7359ef7645eee2d243a1df0649"
        },
        {
          "url": "https://git.kernel.org/stable/c/dbd20bb904ad5731aaca8d009367a930d6ada111"
        },
        {
          "url": "https://git.kernel.org/stable/c/09737db4c891eba25e6f6383a7c38afd4acc883f"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa1b46dcdc7baaf5fec0be25782ef24b26aa209e"
        }
      ],
      "title": "block: fix rq-qos breakage from skipping rq_qos_done_bio()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49266",
    "datePublished": "2025-02-26T01:56:15.709Z",
    "dateReserved": "2025-02-26T01:49:39.297Z",
    "dateUpdated": "2026-05-23T15:21:48.745Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49266",
      "date": "2026-09-15",
      "epss": "0.00281",
      "percentile": "0.20551"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49266\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:03.527\",\"lastModified\":\"2026-06-17T05:17:32.933\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblock: fix rq-qos breakage from skipping rq_qos_done_bio()\\n\\na647a524a467 (\\\"block: don\u0027t call rq_qos_ops-\u003edone_bio if the bio isn\u0027t\\ntracked\\\") made bio_endio() skip rq_qos_done_bio() if BIO_TRACKED is not set.\\nWhile this fixed a potential oops, it also broke blk-iocost by skipping the\\ndone_bio callback for merged bios.\\n\\nBefore, whether a bio goes through rq_qos_throttle() or rq_qos_merge(),\\nrq_qos_done_bio() would be called on the bio on completion with BIO_TRACKED\\ndistinguishing the former from the latter. rq_qos_done_bio() is not called\\nfor bios which wenth through rq_qos_merge(). This royally confuses\\nblk-iocost as the merged bios never finish and are considered perpetually\\nin-flight.\\n\\nOne reliably reproducible failure mode is an intermediate cgroup geting\\nstuck active preventing its children from being activated due to the\\nleaf-only rule, leading to loss of control. The following is from\\nresctl-bench protection scenario which emulates isolating a web server like\\nworkload from a memory bomb run on an iocost configuration which should\\nyield a reasonable level of protection.\\n\\n  # cat /sys/block/nvme2n1/device/model\\n  Samsung SSD 970 PRO 512GB\\n  # cat /sys/fs/cgroup/io.cost.model\\n  259:0 ctrl=user model=linear rbps=834913556 rseqiops=93622 rrandiops=102913 wbps=618985353 wseqiops=72325 wrandiops=71025\\n  # cat /sys/fs/cgroup/io.cost.qos\\n  259:0 enable=1 ctrl=user rpct=95.00 rlat=18776 wpct=95.00 wlat=8897 min=60.00 max=100.00\\n  # resctl-bench -m 29.6G -r out.json run protection::scenario=mem-hog,loops=1\\n  ...\\n  Memory Hog Summary\\n  ==================\\n\\n  IO Latency: R p50=242u:336u/2.5m p90=794u:1.4m/7.5m p99=2.7m:8.0m/62.5m max=8.0m:36.4m/350m\\n              W p50=221u:323u/1.5m p90=709u:1.2m/5.5m p99=1.5m:2.5m/9.5m max=6.9m:35.9m/350m\\n\\n  Isolation and Request Latency Impact Distributions:\\n\\n                min   p01   p05   p10   p25   p50   p75   p90   p95   p99   max  mean stdev\\n  isol%       15.90 15.90 15.90 40.05 57.24 59.07 60.01 74.63 74.63 90.35 90.35 58.12 15.82\\n  lat-imp%        0     0     0     0     0  4.55 14.68 15.54 233.5 548.1 548.1 53.88 143.6\\n\\n  Result: isol=58.12:15.82% lat_imp=53.88%:143.6 work_csv=100.0% missing=3.96%\\n\\nThe isolation result of 58.12% is close to what this device would show\\nwithout any IO control.\\n\\nFix it by introducing a new flag BIO_QOS_MERGED to mark merged bios and\\ncalling rq_qos_done_bio() on them too. For consistency and clarity, rename\\nBIO_TRACKED to BIO_QOS_THROTTLED. The flag checks are moved into\\nrq_qos_done_bio() so that it\u0027s next to the code paths that set the flags.\\n\\nWith the patch applied, the above same benchmark shows:\\n\\n  # resctl-bench -m 29.6G -r out.json run protection::scenario=mem-hog,loops=1\\n  ...\\n  Memory Hog Summary\\n  ==================\\n\\n  IO Latency: R p50=123u:84.4u/985u p90=322u:256u/2.5m p99=1.6m:1.4m/9.5m max=11.1m:36.0m/350m\\n              W p50=429u:274u/995u p90=1.7m:1.3m/4.5m p99=3.4m:2.7m/11.5m max=7.9m:5.9m/26.5m\\n\\n  Isolation and Request Latency Impact Distributions:\\n\\n                min   p01   p05   p10   p25   p50   p75   p90   p95   p99   max  mean stdev\\n  isol%       84.91 84.91 89.51 90.73 92.31 94.49 96.36 98.04 98.71 100.0 100.0 94.42  2.81\\n  lat-imp%        0     0     0     0     0  2.81  5.73 11.11 13.92 17.53 22.61  4.10  4.68\\n\\n  Result: isol=94.42:2.81% lat_imp=4.10%:4.68 work_csv=58.34% missing=0%\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: block: fix rq-qos breakage from skipping rq_qos_done_bio() a647a524a467 (\\\"block: don\u0027t call rq_qos_ops-\u0026gt;done_bio if the bio isn\u0027t tracked\\\") hizo que bio_endio() saltara rq_qos_done_bio() si BIO_TRACKED no est\u00e1 configurado. Si bien esto solucion\u00f3 un posible error, tambi\u00e9n rompi\u00f3 blk-iocost al saltarse la devoluci\u00f3n de llamada done_bio para bios fusionados. Antes, ya sea que una bio pase por rq_qos_throttle() o rq_qos_merge(), rq_qos_done_bio() se llamar\u00eda en la bio al completarse con BIO_TRACKED distinguiendo la primera de la segunda. rq_qos_done_bio() no se llama para bios que pasaron por rq_qos_merge(). Esto confunde mucho a blk-iocost, ya que las bios fusionadas nunca terminan y se consideran en constante funcionamiento. Un modo de falla reproducible de manera confiable es un cgroup intermedio que se queda bloqueado en modo activo, lo que impide que sus hijos se activen debido a la regla de solo hojas, lo que lleva a la p\u00e9rdida de control. Lo siguiente es del escenario de protecci\u00f3n de resctl-bench que emula el aislamiento de una carga de trabajo similar a la de un servidor web de una bomba de memoria ejecutada en una configuraci\u00f3n de iocost que deber\u00eda producir un nivel razonable de protecci\u00f3n. # cat /sys/block/nvme2n1/device/model Samsung SSD 970 PRO 512GB # cat /sys/fs/cgroup/io.cost.model 259:0 ctrl=usuario model=linear rbps=834913556 rseqiops=93622 rrandiops=102913 wbps=618985353 wseqiops=72325 wrandiops=71025 # cat /sys/fs/cgroup/io.cost.qos 259:0 enable=1 ctrl=usuario rpct=95.00 rlat=18776 wpct=95.00 wlat=8897 m\u00edn=60.00 m\u00e1x=100.00 # resctl-bench -m 29.6G -r out.json ejecutar protection::scenario=mem-hog,loops=1 ... Resumen de acaparadores de memoria ================== Latencia de E/S: R p50=242u:336u/2,5 m p90=794u:1,4 m/7,5 m p99=2,7 m:8,0 m/62,5 m m\u00e1x.=8,0 m:36,4 m/350 m W p50=221u:323u/1,5 m p90=709u:1,2 m/5,5 m p99=1,5 m:2,5 m/9,5 m m\u00e1x.=6,9 m:35,9 m/350 m Distribuciones del impacto de latencia de solicitud y aislamiento: m\u00edn. p01 p05 p10 p25 p50 p75 p90 p95 p99 m\u00e1x. media desviaci\u00f3n est\u00e1ndar isol% 15,90 15,90 15,90 40,05 57,24 59,07 60,01 74,63 74,63 90,35 90,35 58,12 15,82 lat-imp% 0 0 0 0 0 4,55 14,68 15,54 233,5 548,1 548,1 53,88 143,6 Resultado: isol=58,12:15,82% lat_imp=53,88%:143,6 work_csv=100,0% missing=3,96% El resultado de aislamiento de 58,12% es cercano a lo que este dispositivo mostrar\u00eda sin ning\u00fan control de E/S. Arr\u00e9glelo introduciendo una nueva bandera BIO_QOS_MERGED para marcar las bios fusionadas y llamando a rq_qos_done_bio() en ellas tambi\u00e9n. Para mayor coherencia y claridad, cambie el nombre de BIO_TRACKED a BIO_QOS_THROTTLED. Las comprobaciones de banderas se mueven a rq_qos_done_bio() para que est\u00e9n junto a las rutas de c\u00f3digo que establecen las banderas. Con el parche aplicado, el mismo punto de referencia anterior muestra: # resctl-bench -m 29.6G -r out.json run protection::scenario=mem-hog,loops=1 ... Resumen de acaparamiento de memoria ================== Latencia de E/S: R p50=123u:84.4u/985u p90=322u:256u/2.5m p99=1.6m:1.4m/9.5m m\u00e1x.=11.1m:36.0m/350m W p50=429u:274u/995u p90=1.7m:1.3m/4.5m p99=3.4m:2.7m/11.5m m\u00e1x.=7.9m:5.9m/26.5m Distribuciones de impacto de latencia de solicitud y aislamiento: min p01 p05 p10 p25 p50 p75 p90 p95 p99 media m\u00e1xima desviaci\u00f3n est\u00e1ndar isol% 84,91 84,91 89,51 90,73 92,31 94,49 96,36 98,04 98,71 100,0 100,0 94,42 2,81 lat-imp% 0 0 0 0 0 2,81 5,73 11,11 13,92 17,53 22,61 4,10 4,68 Resultado: isol=94,42:2,81% lat_imp=4,10%:4,68 work_csv=58,34% missing=0%\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"block/bio.c\",\"block/blk-iolatency.c\",\"block/blk-rq-qos.h\",\"include/linux/blk_types.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a647a524a46736786c95cdb553a070322ca096e3\",\"lessThan\":\"af9452dfdba4bf7359ef7645eee2d243a1df0649\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a647a524a46736786c95cdb553a070322ca096e3\",\"lessThan\":\"dbd20bb904ad5731aaca8d009367a930d6ada111\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a647a524a46736786c95cdb553a070322ca096e3\",\"lessThan\":\"09737db4c891eba25e6f6383a7c38afd4acc883f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a647a524a46736786c95cdb553a070322ca096e3\",\"lessThan\":\"aa1b46dcdc7baaf5fec0be25782ef24b26aa209e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"db60edbfff332a6a5477c367af8125f034570989\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"004b8f8a691205a93d9e80d98b786b2b97424d6e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.241\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.14.11\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"block/bio.c\",\"block/blk-iolatency.c\",\"block/blk-rq-qos.h\",\"include/linux/blk_types.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.54\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16.19\",\"lessThanOrEqual\":\"5.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17.2\",\"lessThanOrEqual\":\"5.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.241\",\"versionEndExcluding\":\"5.11\",\"matchCriteriaId\":\"FC16C741-04D3-418A-87C6-8EE23F15B67C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.14.11\",\"versionEndExcluding\":\"5.15\",\"matchCriteriaId\":\"3C67C5EC-7ED4-407D-9800-198B7F076D0F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.1\",\"versionEndExcluding\":\"5.15.54\",\"matchCriteriaId\":\"D89FEC10-B807-40F2-8448-B75153A7B3AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.19\",\"matchCriteriaId\":\"20C43679-0439-405A-B97F-685BEE50613B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17\",\"versionEndExcluding\":\"5.17.2\",\"matchCriteriaId\":\"210C679C-CF84-44A3-8939-E629C87E54BF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"40D9C0D1-0F32-4A2B-9840-1072F5497540\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"0460DA88-8FE1-46A2-9DDA-1F1ABA552E71\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"AF55383D-4DF2-45DC-93F7-571F4F978EAB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"9E9481B2-8AA6-4CBD-B5D3-C10F51FF6D01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"EBD45831-4B79-42BC-ABC0-86870F0DEA89\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"948A6B8D-1B72-4945-8680-354E53BE1C80\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/09737db4c891eba25e6f6383a7c38afd4acc883f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aa1b46dcdc7baaf5fec0be25782ef24b26aa209e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/af9452dfdba4bf7359ef7645eee2d243a1df0649\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dbd20bb904ad5731aaca8d009367a930d6ada111\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T21:02:34+00:00",
      "cve": "CVE-2022-49266",
      "id": "CVE-2022-49266",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: block: fix rq-qos breakage from skipping rq_qos_done_bio()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49266.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T01:32:35Z",
      "cve": "CVE-2022-49266",
      "id": "CVE-2022-49266",
      "initial_release_date": "2025-02-27T03:09:44Z",
      "product_status:known_affected": "334",
      "product_status:known_not_affected": "401",
      "product_status:recommended": "223",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49266",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49266.json",
      "version": "49"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.