LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49987: md: call __md_stop_writes in md_stop

In the Linux kernel, the following vulnerability has been resolved: md: call __md_stop_writes in md_stop From the link [1], we can see raid1d was running even after the path raid_dtr -> md_stop -> __md_stop. Let's stop write first in destructor to align with normal md-raid to fix the KASAN issue. [1]. https://lore.kernel.org/linux-raid/CAPhsuW5gc4AakdGNdF8ubpezAuDLFOYUO_sfMZcec6hQFm8nhg@mail.gmail.com/T/#m7f12bf90481c02c6d2da68c64aeed4779b7df74a

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2022-49987 is a Linux kernel md RAID bug where write activity could continue during a stop/destructor path, leading to a KASAN-detected issue. The public record does not provide CVSS, CWE, or business-impact detail. Systems using affected Linux kernels and md RAID functionality are the most relevant exposure group.

Executive priority

Handle through normal kernel patch management, with higher priority for servers depending on Linux software RAID. The current public evidence does not justify emergency treatment, but kernel memory-safety bugs can affect stability and should not be deferred indefinitely.

Technical view

The fix changes md_stop behavior to call __md_stop_writes, aligning destructor handling with normal md-raid shutdown. The source says raid1d could still run after raid_dtr -> md_stop -> __md_stop, causing a KASAN issue. Multiple Linux stable commits are referenced as fixes across branches.

Likely exposure

Exposure is most plausible on Linux systems using md RAID, especially RAID1 paths, on affected kernel versions before the referenced stable fixes. Distribution kernels may differ, so asset exposure must be mapped through vendor kernel package advisories rather than upstream version strings alone.

Exploitation context

CISA KEV status is false in the source bundle, and no cited source states active exploitation. The available evidence describes a kernel lifecycle/shutdown bug detected by KASAN, not a documented public exploit path or remote attack scenario.

Researcher notes

Evidence is limited to the upstream Linux CVE description and stable commit references. No CVSS, CWE, exploitability analysis, or complete affected distro matrix is supplied. Treat impact analysis as incomplete until vendor advisories or kernel maintainers provide more detail.

Mitigation direction

  • Apply Linux kernel updates containing the referenced stable fixes.
  • Check distribution vendor advisories for backported fixes.
  • Prioritize systems using md RAID or RAID1 configurations.
  • Plan maintenance windows for kernel upgrades and reboot validation.
  • Monitor kernel logs for md RAID stop or KASAN-related errors.

Validation and detection

  • Inventory Linux kernel versions across managed systems.
  • Identify hosts using md RAID, especially RAID1.
  • Compare deployed kernels with vendor-fixed package versions.
  • Confirm kernel updates include the upstream stable fix commits.
  • Review logs for md shutdown anomalies after patching.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49987 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux48df498daf62e1292868005675331929305067f0, 48df498daf62e1292868005675331929305067f0, 48df498daf62e1292868005675331929305067f0, 48df498daf62e1292868005675331929305067f0, 48df498daf62e1292868005675331929305067f0, 48df498daf62e1292868005675331929305067f0, 48df498daf62e1292868005675331929305067f0unaffected
LinuxLinux4.12, 0, 4.14.292, 4.19.257, 5.4.212, 5.10.140, 5.15.64, 5.19.6, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.