GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49995 (GCVE-0-2022-49995)

Vulnerability from cvelistv5 – Published: 2025-06-18 11:00 – Updated: 2026-08-05 08:57
VLAI
Title
writeback: avoid use-after-free after removing device
Summary
In the Linux kernel, the following vulnerability has been resolved: writeback: avoid use-after-free after removing device When a disk is removed, bdi_unregister gets called to stop further writeback and wait for associated delayed work to complete. However, wb_inode_writeback_end() may schedule bandwidth estimation dwork after this has completed, which can result in the timer attempting to access the just freed bdi_writeback. Fix this by checking if the bdi_writeback is alive, similar to when scheduling writeback work. Since this requires wb->work_lock, and wb_inode_writeback_end() may get called from interrupt, switch wb->work_lock to an irqsafe lock.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 45a2966fd64147518dc5bca25f447bd0fb5359ac , < f96b9f7c1676923bce871e728bb49c0dfa5013cc (git)
Affected: 45a2966fd64147518dc5bca25f447bd0fb5359ac , < 9a6c710f3bc10bc9cc23e1c080b53245b7f9d5b7 (git)
Affected: 45a2966fd64147518dc5bca25f447bd0fb5359ac , < f87904c075515f3e1d8f4a7115869d3b914674fd (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.64 , ≤ 5.15.* (semver)
Unaffected: 5.19.6 , ≤ 5.19.* (semver)
Unaffected: 6.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/fs-writeback.c",
            "mm/backing-dev.c",
            "mm/page-writeback.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f96b9f7c1676923bce871e728bb49c0dfa5013cc",
              "status": "affected",
              "version": "45a2966fd64147518dc5bca25f447bd0fb5359ac",
              "versionType": "git"
            },
            {
              "lessThan": "9a6c710f3bc10bc9cc23e1c080b53245b7f9d5b7",
              "status": "affected",
              "version": "45a2966fd64147518dc5bca25f447bd0fb5359ac",
              "versionType": "git"
            },
            {
              "lessThan": "f87904c075515f3e1d8f4a7115869d3b914674fd",
              "status": "affected",
              "version": "45a2966fd64147518dc5bca25f447bd0fb5359ac",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/fs-writeback.c",
            "mm/backing-dev.c",
            "mm/page-writeback.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.64",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.6",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwriteback: avoid use-after-free after removing device\n\nWhen a disk is removed, bdi_unregister gets called to stop further\nwriteback and wait for associated delayed work to complete.  However,\nwb_inode_writeback_end() may schedule bandwidth estimation dwork after\nthis has completed, which can result in the timer attempting to access the\njust freed bdi_writeback.\n\nFix this by checking if the bdi_writeback is alive, similar to when\nscheduling writeback work.\n\nSince this requires wb-\u003ework_lock, and wb_inode_writeback_end() may get\ncalled from interrupt, switch wb-\u003ework_lock to an irqsafe lock."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached via local filesystem writeback and block-device teardown (USB/removable media, del_gendisk \u2192 bdi_unregister), not by processing remote network packets. An attacker needs local access to dirty pages on an affected device.\nAC:L - The attacker can drive both sides of the race by generating writeback I/O and then removing or ejecting the device (e.g. udisks power-off or surprise unplug), and the delayed bw_dwork (~200ms) widens the window; this UAF was hit in practice (KASAN).\nPR:L - An unprivileged user can write to auto-mounted removable storage and trigger or cause its removal without CAP_SYS_ADMIN in the init namespace. Root-only sysfs delete is not required for the worst reasonable removable-media scenario.\nUI:N - The attacker can complete the full sequence (dirty data then eject/remove the device they wrote to) without relying on a separate victim action.\nS:U - This is a host-kernel use-after-free leading to privilege escalation within the same OS security authority, not a VM escape or IOMMU/cross-boundary breakout.\nC:H - Use-after-free of the bdi_writeback object lets an attacker reclaim and control freed kernel memory, enabling arbitrary kernel read primitives.\nI:H - The same UAF is exploitable via heap spray for arbitrary kernel writes and control-flow hijacking through the delayed bandwidth-update work path.\nA:H - The freed bdi_writeback is accessed from delayed work (observed as a KASAN splat), which can oops/panic the kernel even when not fully exploited."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:57:04.391Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f96b9f7c1676923bce871e728bb49c0dfa5013cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a6c710f3bc10bc9cc23e1c080b53245b7f9d5b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/f87904c075515f3e1d8f4a7115869d3b914674fd"
        }
      ],
      "title": "writeback: avoid use-after-free after removing device",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49995",
    "datePublished": "2025-06-18T11:00:55.352Z",
    "dateReserved": "2025-06-18T10:57:27.387Z",
    "dateUpdated": "2026-08-05T08:57:04.391Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49995",
      "date": "2026-09-16",
      "epss": "0.00226",
      "percentile": "0.13457"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49995\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-06-18T11:15:27.227\",\"lastModified\":\"2026-08-04T10:18:02.403\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwriteback: avoid use-after-free after removing device\\n\\nWhen a disk is removed, bdi_unregister gets called to stop further\\nwriteback and wait for associated delayed work to complete.  However,\\nwb_inode_writeback_end() may schedule bandwidth estimation dwork after\\nthis has completed, which can result in the timer attempting to access the\\njust freed bdi_writeback.\\n\\nFix this by checking if the bdi_writeback is alive, similar to when\\nscheduling writeback work.\\n\\nSince this requires wb-\u003ework_lock, and wb_inode_writeback_end() may get\\ncalled from interrupt, switch wb-\u003ework_lock to an irqsafe lock.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: writeback: evitar el Use-After-Free tras retirar un dispositivo. Al retirar un disco, se llama a bdi_unregister para detener la escritura diferida y esperar a que se complete el trabajo retrasado asociado. Sin embargo, wb_inode_writeback_end() puede programar la estimaci\u00f3n de ancho de banda dwork despu\u00e9s de que esto se haya completado, lo que puede provocar que el temporizador intente acceder al bdi_writeback reci\u00e9n liberado. Para solucionar esto, verifique si bdi_writeback est\u00e1 activo, de forma similar a cuando se programa la escritura diferida. Dado que esto requiere wb-\u0026gt;work_lock y wb_inode_writeback_end() puede ser llamado desde una interrupci\u00f3n, cambie wb-\u0026gt;work_lock a un bloqueo irqsafe.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/fs-writeback.c\",\"mm/backing-dev.c\",\"mm/page-writeback.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"45a2966fd64147518dc5bca25f447bd0fb5359ac\",\"lessThan\":\"f96b9f7c1676923bce871e728bb49c0dfa5013cc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"45a2966fd64147518dc5bca25f447bd0fb5359ac\",\"lessThan\":\"9a6c710f3bc10bc9cc23e1c080b53245b7f9d5b7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"45a2966fd64147518dc5bca25f447bd0fb5359ac\",\"lessThan\":\"f87904c075515f3e1d8f4a7115869d3b914674fd\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/fs-writeback.c\",\"mm/backing-dev.c\",\"mm/page-writeback.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.64\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19.6\",\"lessThanOrEqual\":\"5.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15\",\"versionEndExcluding\":\"5.15.64\",\"matchCriteriaId\":\"7D84F1BC-C9DF-4483-81B0-7377D6BFAEE6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.19.6\",\"matchCriteriaId\":\"89E99903-E16D-475D-954B-2BAC46C98262\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E8BD11A3-8643-49B6-BADE-5029A0117325\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F0AD220-F6A9-4012-8636-155F1B841FAD\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/9a6c710f3bc10bc9cc23e1c080b53245b7f9d5b7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f87904c075515f3e1d8f4a7115869d3b914674fd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f96b9f7c1676923bce871e728bb49c0dfa5013cc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:41:27+00:00",
      "cve": "CVE-2022-49995",
      "id": "CVE-2022-49995",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "605",
      "product_status:known_affected": "36",
      "product_status:known_not_affected": "120",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: writeback: avoid use-after-free after removing device",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49995.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T02:24:06Z",
      "cve": "CVE-2022-49995",
      "id": "CVE-2022-49995",
      "initial_release_date": "2025-06-19T03:44:31Z",
      "product_status:known_affected": "344",
      "product_status:known_not_affected": "389",
      "product_status:recommended": "253",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49995",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49995.json",
      "version": "41"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.