Security readout for executives and security teams
Plain-English summary
CVE-2022-49413 is a Linux kernel flaw in BFQ I/O scheduling and cgroup handling. A local user or workload could potentially trigger use-after-free memory corruption when I/O is merged with stale cgroup information. Business risk is highest on shared Linux systems, container hosts, and platforms running affected kernels.
Executive priority
Treat as high priority for Linux fleets with shared users, containers, or multi-tenant workloads. It is not remotely exploitable based on the provided evidence, but kernel memory corruption can lead to severe host compromise if a local attacker succeeds.
Technical view
The flaw is in bfq_merge_bio(). When a process moves cgroups, or writeback submits bios for another cgroup, BFQ could use stale bic cgroup data. That can merge bios or bfqqs across different or dead cgroups, creating possible CWE-416 use-after-free. CVSS 3.1 is 7.8, local attack vector, low complexity, low privileges.
Likely exposure
Exposure is limited to Linux systems running affected kernel versions or unfixed downstream backports. Risk is more relevant where BFQ, cgroups, writeback, containers, or shared local workloads are present. The source bundle does not prove all distributions or configurations are affected.
Exploitation context
The source bundle marks KEV as false and provides no evidence of active exploitation. The vulnerability requires local privileges, not network access. It is still serious because successful memory corruption in kernel code can affect confidentiality, integrity, and availability.
Researcher notes
Focus review on BFQ request merging, bic cgroup refresh behavior, and lifetime handling for bfqqs from migrated or dead cgroups. Evidence supports a fixed kernel logic bug, but the bundle does not include exploit proof, distribution impact detail, or runtime configuration requirements.
Mitigation direction
- Update affected Linux kernels to vendor-fixed builds containing the referenced stable fixes.
- Check distribution advisories because vendor kernels may backport fixes without changing upstream version numbers.
- Prioritize shared hosts, container platforms, CI runners, and systems with untrusted local workloads.
- If immediate patching is unavailable, follow vendor guidance and reduce untrusted local workload exposure.
Validation and detection
- Inventory Linux kernel versions and compare them with affected ranges and vendor advisories.
- Confirm whether deployed kernels include the relevant BFQ stable fix commits or backports.
- Identify hosts using BFQ, cgroups, containers, or heavy writeback workloads for prioritization.
- Verify patch status through distribution package metadata, changelogs, or kernel source provenance.
Public sources used
- CVE Program
- CVE List V5
- Linux stable fix da9f3025d595956410ceaab2bea01980d7775948
- Linux stable fix b06691af08b41dfd81052a3362514d9827b44bb1
- Linux stable fix e8821f45612f2e6d9adb9c6ba0fb4184f57692aa
- Linux stable fix d9165200c5627a2cf4408eefabdf0058bdf95e1a
- Linux stable fix 2a1077f17169a6059992a0bbdb330e0abad1e6d9
- Linux stable fix ea591cd4eb270393810e7be01feb8fde6a34fbbe
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49413 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/da9f3025d595956410ceaab2bea01980d7775948CVE reference, Linux
- https://git.kernel.org/stable/c/b06691af08b41dfd81052a3362514d9827b44bb1CVE reference, Linux
- https://git.kernel.org/stable/c/e8821f45612f2e6d9adb9c6ba0fb4184f57692aaCVE reference, Linux
- https://git.kernel.org/stable/c/d9165200c5627a2cf4408eefabdf0058bdf95e1aCVE reference, Linux
- https://git.kernel.org/stable/c/2a1077f17169a6059992a0bbdb330e0abad1e6d9CVE reference, Linux
- https://git.kernel.org/stable/c/ea591cd4eb270393810e7be01feb8fde6a34fbbeCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.