In the Linux kernel, the following vulnerability has been resolved:
blk-mq: avoid double ->queue_rq() because of early timeout
David Jeffery found one double ->queue_rq() issue, so far it can
be triggered in VM use case because of long vmexit latency or preempt
latency of vCPU pthread or long page fault in vCPU pthread, then block
IO req could be timed out before queuing the request to hardware but after
calling blk_mq_start_request() during ->queue_rq(), then timeout handler
may handle it by requeue, then double ->queue_rq() is caused, and kernel
panic.
So far, it is driver's responsibility to cover the race between timeout
and completion, so it seems supposed to be solved in driver in theory,
given driver has enough knowledge.
But it is really one common problem, lots of driver could have similar
issue, and could be hard to fix all affected drivers, even it isn't easy
for driver to handle the race. So David suggests this patch by draining
in-progress ->queue_rq() for solving this issue.
References
Configurations
Configuration 1 (hide)
|
History
06 Feb 2026, 13:44
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| First Time |
Linux
Linux linux Kernel |
|
| CWE | NVD-CWE-noinfo | |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| References | () https://git.kernel.org/stable/c/7a73c54a3750895888ab586896736c9434e062a1 - Patch | |
| References | () https://git.kernel.org/stable/c/82c229476b8f6afd7e09bc4dc77d89dc19ff7688 - Patch | |
| References | () https://git.kernel.org/stable/c/8b3d6b029a552d2978bbac275303d11419826a69 - Patch |
07 Oct 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-07 16:15
Updated : 2026-02-06 13:44
NVD link : CVE-2022-50554
Mitre link : CVE-2022-50554
CVE.ORG link : CVE-2022-50554
JSON object : View
Products Affected
linux
- linux_kernel
CWE