LiveActive security incident?Get immediate response
CVE Record

CVE-2022-48846: block: release rq qos structures for queue without disk

In the Linux kernel, the following vulnerability has been resolved: block: release rq qos structures for queue without disk blkcg_init_queue() may add rq qos structures to request queue, previously blk_cleanup_queue() calls rq_qos_exit() to release them, but commit 8e141f9eb803 ("block: drain file system I/O on del_gendisk") moves rq_qos_exit() into del_gendisk(), so memory leak is caused because queues may not have disk, such as un-present scsi luns, nvme admin queue, ... Fixes the issue by adding rq_qos_exit() to blk_cleanup_queue() back. BTW, v5.18 won't need this patch any more since we move blkcg_init_queue()/blkcg_exit_queue() into disk allocation/release handler, and patches have been in for-5.18/block.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

CVE-2022-48846 is a Linux kernel memory leak in block request-queue cleanup. Some queues without disks could keep request QoS data after cleanup. The source does not show remote code execution, privilege escalation, or active exploitation. Business urgency is mainly routine kernel maintenance for affected Linux 5.15, 5.16, and 5.17 lines.

Executive priority

Treat this as standard patch-cycle work unless affected storage-heavy systems show unexplained kernel memory growth. There is no source-supported active exploitation signal, but kernel memory leaks can still affect availability over time.

Technical view

The issue is in Linux block layer cleanup. blkcg_init_queue() could add rq_qos structures, while rq_qos_exit() had been moved from blk_cleanup_queue() to del_gendisk(). Queues without disks, such as unpresent SCSI LUNs or NVMe admin queues, could skip that release path and leak memory. The fix adds rq_qos_exit() back to blk_cleanup_queue().

Likely exposure

Exposure is likely limited to systems running affected Linux kernel versions or downstream builds containing commit 8e141f9eb803 without the stable fixes. The bundle names Linux 5.15, 5.16.17, and 5.17-related affected data, but exact downstream vendor backport status must be verified per distribution.

Exploitation context

The provided sources do not report active exploitation, and KEV is false. The described impact is a kernel memory leak during block queue cleanup for queues without disks. The sources do not provide exploit prerequisites, attack vectors, CVSS, or evidence of public weaponization.

Researcher notes

Evidence is narrow but clear: the bug is a missing rq_qos_exit() release path after cleanup responsibility moved to del_gendisk(). The CVE bundle lacks CVSS, CWE, exploitability analysis, and precise downstream fixed package versions, so validation should focus on commit presence and vendor backports.

Mitigation direction

  • Identify Linux systems running affected 5.15, 5.16, or 5.17 kernels.
  • Apply vendor kernel updates that include the referenced stable fixes.
  • Verify downstream distribution advisories for backported fixes and package versions.
  • Prioritize systems with frequent block device discovery, SCSI, or NVMe queue churn.
  • Do not deploy custom mitigations without vendor guidance.

Validation and detection

  • Inventory kernel versions and distribution package changelogs.
  • Check whether the referenced stable commits are present in the running kernel source package.
  • Review kernel memory trend telemetry on affected storage-heavy hosts.
  • Confirm no affected kernel remains after patching or rebooting.
  • Document vendor advisory status where fixed package mapping is unclear.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-48846 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux8e141f9eb803e209714a80aa6ec073893f94c526, 8e141f9eb803e209714a80aa6ec073893f94c526, 8e141f9eb803e209714a80aa6ec073893f94c526unaffected
LinuxLinux5.15, 0, 5.15.31, 5.16.17, 5.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.