CVE-2022-49406: block: Fix potential deadlock in blk_ia_range_sysfs_show()
In the Linux kernel, the following vulnerability has been resolved:
block: Fix potential deadlock in blk_ia_range_sysfs_show()
When being read, a sysfs attribute is already protected against removal
with the kobject node active reference counter. As a result, in
blk_ia_range_sysfs_show(), there is no need to take the queue sysfs
lock when reading the value of a range attribute. Using the queue sysfs
lock in this function creates a potential deadlock situation with the
disk removal, something that a lockdep signals with a splat when the
device is removed:
[ 760.703551] Possible unsafe locking scenario:
[ 760.703551]
[ 760.703554] CPU0 CPU1
[ 760.703556] ---- ----
[ 760.703558] lock(&q->sysfs_lock);
[ 760.703565] lock(kn->active#385);
[ 760.703573] lock(&q->sysfs_lock);
[ 760.703579] lock(kn->active#385);
[ 760.703587]
[ 760.703587] *** DEADLOCK ***
Solve this by removing the mutex_lock()/mutex_unlock() calls from
blk_ia_range_sysfs_show().
Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can deadlock part of the block device subsystem, potentially making a system unavailable. It is a local availability risk, not a remote takeover or data theft issue. The public record points to kernel stable commits as the fix evidence.
Executive priority
Treat as a routine-to-prioritized kernel availability fix. It should enter normal patch cycles, with higher urgency for shared Linux hosts where local users can interact with block device sysfs paths.
Technical view
CVE-2022-49406 is a CWE-667 locking flaw in blk_ia_range_sysfs_show(). The function took q->sysfs_lock while sysfs already held kobject active protection, creating a lock-order deadlock with disk removal. CVSS 3.1 is 5.5, local, low complexity, low privileges, no confidentiality or integrity impact, high availability impact.
Likely exposure
Exposure is limited to Linux systems running affected kernel builds. The source data lists Linux kernel versions including 5.16, 5.17.14, 5.18.3, and 5.19, but version-range details are incomplete. Local access is required.
Exploitation context
The provided sources do not show active exploitation, and KEV is false. The issue is framed as a potential deadlock detected by lockdep during device removal, with impact centered on availability rather than code execution.
Researcher notes
Evidence supports a local deadlock caused by unnecessary q->sysfs_lock use in a sysfs show path. The public bundle identifies stable commits, but does not provide complete affected or fixed distribution package mappings.
Mitigation direction
Update to a vendor kernel containing the referenced stable kernel fixes.
If no fixed package is available, follow Linux distribution vendor guidance.
Prioritize multi-user systems and systems with local untrusted users.
Plan reboot requirements for kernel update deployment.
Validation and detection
Inventory Linux kernel versions across affected hosts.
Check vendor advisories or changelogs for CVE-2022-49406 or referenced commits.
Confirm the running kernel includes the blk_ia_range_sysfs_show() locking fix.
Rerun vulnerability scanning after patched kernel activation.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cwe · low confidence lookup
CWE-667: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
CWE-667 · source CWE mapping
Improper Locking
Improper Locking represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.