Security readout for executives and security teams
Plain-English summary
This is a Linux kernel reliability vulnerability in block queue handling. During queue reinitialization, background work can race with an elevator scheduler switch, leaving the kernel using freed or invalid scheduler state. The documented impact is kernel panic, which can cause service interruption on affected Linux systems.
Executive priority
Treat this as a stability and availability risk rather than a confirmed intrusion risk. Prioritize patching on critical Linux infrastructure, storage-heavy workloads, and systems where unexpected kernel panics would disrupt customer-facing services or operations.
Technical view
The flaw is a race in blk-mq during hardware queue reinitialization. Freezing the queue blocks new request allocation but does not stop hctx run_work. That work can observe an elevator pointer being torn down, causing use-after-free or NULL dereference paths such as kyber_has_work and blk_mq_run_work_fn.
Likely exposure
Exposure applies to Linux systems running affected kernel versions listed by the CVE source, including 4.19, 5.10.258, 5.15.209, 5.19.17, 6.0.3, and 6.1. Confirm distro backports because package versions may not map directly to upstream kernel numbers.
Exploitation context
The provided sources do not report active exploitation, and KEV is false. The source describes a race causing kernel panics during queue reinitialization, with an NVMe controller reset shown as an example. There is no public exploit path or attacker prerequisite stated in the bundle.
Researcher notes
Evidence is clear on root cause and fix direction, but incomplete on exploitability, CVSS, prerequisites, and affected distro packages. Avoid assuming remote exploitability. The useful validation path is kernel provenance, stable-commit inclusion, and crash-signature correlation.
Mitigation direction
- Apply vendor kernel updates that include the referenced upstream stable fixes.
- Confirm fixes through your distribution advisory, not only upstream version numbers.
- Prioritize systems where kernel panics cause high business impact.
- Schedule reboots where required for the updated kernel to take effect.
- Monitor for recurring blk-mq, kyber, or NVMe reset panics.
Validation and detection
- Inventory Linux kernel versions across servers, appliances, and images.
- Check whether each kernel includes one of the referenced stable commits or a vendor backport.
- Review crash logs for blk_mq_run_work_fn, kyber_has_work, or elevator teardown traces.
- Validate updated kernels in staging before broad production rollout.
- Confirm production systems booted into the patched kernel after maintenance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50552 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0f90015383cd3f1128bebfbe7a97122d97808046CVE reference, Linux
- https://git.kernel.org/stable/c/9646443f28f33ec545ae303e613c3f476fad4dc1CVE reference, Linux
- https://git.kernel.org/stable/c/63a681bcc32a43528ce0f690569f7f48e59c3963CVE reference, Linux
- https://git.kernel.org/stable/c/c478b3b2900f1834cf9eda5bfef0d5696099505dCVE reference, Linux
- https://git.kernel.org/stable/c/8237c01f1696bc53c470493bf1fe092a107648a6CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.