LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50580: blk-throttle: prevent overflow while calculating wait time

In the Linux kernel, the following vulnerability has been resolved: blk-throttle: prevent overflow while calculating wait time There is a problem found by code review in tg_with_in_bps_limit() that 'bps_limit * jiffy_elapsed_rnd' might overflow. Fix the problem by calling mul_u64_u64_div_u64() instead.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

A math overflow bug existed in a Linux kernel feature that limits how fast disk I/O can run for groups of processes. It was found through code review, not active attacks, and has been fixed in current stable kernels. There is no evidence of exploitation, and the practical risk to most systems is low.

Executive priority

Low priority. Patch through normal kernel update cycles; no known active exploitation and no CVSS or KEV listing in the cited sources.

Technical view

In the Linux kernel block layer's blk-throttle subsystem, tg_with_in_bps_limit() computed wait time using bps_limit * jiffy_elapsed_rnd, which could overflow during 64-bit multiplication. The fix replaces the calculation with mul_u64_u64_div_u64() to handle large operands safely. Affected kernels span 2.6.37 up to versions before 5.10.150, 5.15.75, 5.19.17, 6.0.3, and 6.1.

Likely exposure

Linux systems running affected kernels (2.6.37 through versions before 5.10.150, 5.15.75, 5.19.17, 6.0.3, and 6.1) that use blk-throttle/cgroup I/O throttling. Servers, container hosts, and workloads relying on cgroup block I/O bandwidth limits are most likely to encounter the code path.

Exploitation context

No public exploitation, proof-of-concept, or KEV listing is referenced in the provided sources. The bug was identified through code review and resolved upstream. Triggering a meaningful overflow would require very specific block-throttle configurations and timing on an unpatched kernel; impact pathway is not documented in the bundle.

Researcher notes

Bug is in tg_with_in_bps_limit() within blk-throttle, where bps_limit * jiffy_elapsed_rnd could overflow a 64-bit multiplication. Fix replaces the multiplication with mul_u64_u64_div_u64() to safely compute wait time. No CVSS, CWE, or exploitation telemetry is provided in the bundle. Severity unspecified upstream; treat as a correctness/robustness fix in the cgroup block I/O throttling path. Verify backports landed in your distro's kernel against the listed git.kernel.org commits.

Mitigation direction

  • Update Linux kernel to 5.10.150, 5.15.75, 5.19.17, 6.0.3, 6.1, or later stable release.
  • Apply distribution vendor kernel updates that include the upstream blk-throttle overflow fix.
  • If patching is delayed, review use of blk-throttle/cgroup I/O bandwidth limits on affected hosts.
  • Track kernel.org stable commits referenced in the CVE for backport status across managed fleets.

Validation and detection

  • Check `uname -r` against fixed versions: 5.10.150, 5.15.75, 5.19.17, 6.0.3, 6.1, or newer.
  • Confirm distro kernel changelog references the listed kernel.org stable commits.
  • Inventory hosts using cgroup blkio/io throttling to scope where the code path runs.
  • Re-run vulnerability scanners after patching to confirm CVE-2022-50580 is no longer flagged.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50580 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe43473b7f223ec866f7db273697e76c337c390f9, e43473b7f223ec866f7db273697e76c337c390f9, e43473b7f223ec866f7db273697e76c337c390f9, e43473b7f223ec866f7db273697e76c337c390f9, e43473b7f223ec866f7db273697e76c337c390f9unaffected
LinuxLinux2.6.37, 0, 5.10.150, 5.15.75, 5.19.17, 6.0.3, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.