Security readout for executives and security teams
Plain-English summary
This is a Linux kernel use-after-free flaw in the BFQ I/O scheduler. A local user or workload could potentially trigger memory corruption with high impact to confidentiality, integrity, and availability. It is not remotely exploitable based on the supplied CVSS vector.
Executive priority
Treat as a high-priority kernel maintenance issue, especially for shared Linux infrastructure. It is not evidenced as internet-remote or actively exploited in the supplied sources, but successful local exploitation could have severe system impact.
Technical view
BFQ may queue bios against a cgroup bfq_group that has already been offlined. That group can later be freed while still referenced from a service tree, creating a CWE-416 use-after-free. The fix ensures BFQ operates on an online bfq_group, falling back to the first online parent.
Likely exposure
Exposure is most likely on Linux systems running affected kernel versions with BFQ I/O scheduling and cgroup activity. The vulnerability requires local privileges, so shared systems, multi-user hosts, and environments running untrusted local workloads deserve priority review.
Exploitation context
The supplied data does not show CISA KEV listing or cited evidence of active exploitation. CVSS indicates local attack vector, low complexity, low privileges, and no user interaction, with high impact if exploited.
Researcher notes
Focus analysis on block/bfq-cgroup behavior around offlined bfq_group objects and service-tree references. The key remediation behavior is selecting an online parent when the bio-associated bfq_group is offline. Source evidence is limited to CVE metadata and kernel stable commits.
Mitigation direction
- Upgrade to vendor-supported kernel packages containing the referenced stable fixes.
- Check Linux distribution advisories for exact fixed package versions.
- Prioritize shared hosts and systems running untrusted local workloads.
- Restrict untrusted local access where patching is delayed.
- Confirm BFQ and cgroup exposure before accepting residual risk.
Validation and detection
- Inventory Linux kernel versions across affected systems.
- Determine whether BFQ I/O scheduler is enabled or selectable.
- Verify patched kernels include the referenced stable commits or vendor backports.
- Review vulnerability scanner results against vendor package advisories.
- Document systems where local untrusted users or workloads exist.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit ccddf8cd411c1800863ed357064e56ceffd356bb
- Linux stable commit 51f724bffa3403a5236597e6b75df7329c1ec6e9
- Linux stable commit 6ee0868b0c3ccead5907685fcdcdd0c08dfe4b0b
- Linux stable commit 97bd6c56bdcb41079e488e31df56809e3b2ce628
- Linux stable commit 7781c38552e6cc54ed8e9040279561340516b881
- Linux stable commit 075a53b78b815301f8d3dd1ee2cd99554e34f0dd
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49411 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ccddf8cd411c1800863ed357064e56ceffd356bbCVE reference, Linux
- https://git.kernel.org/stable/c/51f724bffa3403a5236597e6b75df7329c1ec6e9CVE reference, Linux
- https://git.kernel.org/stable/c/6ee0868b0c3ccead5907685fcdcdd0c08dfe4b0bCVE reference, Linux
- https://git.kernel.org/stable/c/97bd6c56bdcb41079e488e31df56809e3b2ce628CVE reference, Linux
- https://git.kernel.org/stable/c/7781c38552e6cc54ed8e9040279561340516b881CVE reference, Linux
- https://git.kernel.org/stable/c/075a53b78b815301f8d3dd1ee2cd99554e34f0ddCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.