{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2022-50086",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2025-06-18T10:57:27.410Z",
        "datePublished": "2025-06-18T11:02:27.283Z",
        "dateUpdated": "2026-05-11T19:12:33.587Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-05-11T19:12:33.587Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: don't allow the same type rq_qos add more than once\n\nIn our test of iocost, we encountered some list add/del corruptions of\ninner_walk list in ioc_timer_fn.\n\nThe reason can be described as follows:\n\ncpu 0\t\t\t\t\tcpu 1\nioc_qos_write\t\t\t\tioc_qos_write\n\nioc = q_to_ioc(queue);\nif (!ioc) {\n        ioc = kzalloc();\n\t\t\t\t\tioc = q_to_ioc(queue);\n\t\t\t\t\tif (!ioc) {\n\t\t\t\t\t\tioc = kzalloc();\n\t\t\t\t\t\t...\n\t\t\t\t\t\trq_qos_add(q, rqos);\n\t\t\t\t\t}\n        ...\n        rq_qos_add(q, rqos);\n        ...\n}\n\nWhen the io.cost.qos file is written by two cpus concurrently, rq_qos may\nbe added to one disk twice. In that case, there will be two iocs enabled\nand running on one disk. They own different iocgs on their active list. In\nthe ioc_timer_fn function, because of the iocgs from two iocs have the\nsame root iocg, the root iocg's walk_list may be overwritten by each other\nand this leads to list add/del corruptions in building or destroying the\ninner_walk list.\n\nAnd so far, the blk-rq-qos framework works in case that one instance for\none type rq_qos per queue by default. This patch make this explicit and\nalso fix the crash above."
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "block/blk-iocost.c",
                        "block/blk-iolatency.c",
                        "block/blk-rq-qos.h",
                        "block/blk-wbt.c"
                    ],
                    "versions": [
                        {
                            "version": "a79050434b45959f397042080fd1d70ffa9bd9df",
                            "lessThan": "0b7f5d7a4d2a72ad9de04ab8ccba2a31904aa638",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "a79050434b45959f397042080fd1d70ffa9bd9df",
                            "lessThan": "08ef66e800a85afc6b54cb95841f6502627eee2e",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "a79050434b45959f397042080fd1d70ffa9bd9df",
                            "lessThan": "0c9bb1acd1d103a3070b2126870eb52761d606ce",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "a79050434b45959f397042080fd1d70ffa9bd9df",
                            "lessThan": "14a6e2eb7df5c7897c15b109cba29ab0c4a791b6",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "block/blk-iocost.c",
                        "block/blk-iolatency.c",
                        "block/blk-rq-qos.h",
                        "block/blk-wbt.c"
                    ],
                    "versions": [
                        {
                            "version": "4.19",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "4.19",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.15.61",
                            "lessThanOrEqual": "5.15.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.18.18",
                            "lessThanOrEqual": "5.18.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.19.2",
                            "lessThanOrEqual": "5.19.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.0",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.19",
                                    "versionEndExcluding": "5.15.61"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.19",
                                    "versionEndExcluding": "5.18.18"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.19",
                                    "versionEndExcluding": "5.19.2"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.19",
                                    "versionEndExcluding": "6.0"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/0b7f5d7a4d2a72ad9de04ab8ccba2a31904aa638"
                },
                {
                    "url": "https://git.kernel.org/stable/c/08ef66e800a85afc6b54cb95841f6502627eee2e"
                },
                {
                    "url": "https://git.kernel.org/stable/c/0c9bb1acd1d103a3070b2126870eb52761d606ce"
                },
                {
                    "url": "https://git.kernel.org/stable/c/14a6e2eb7df5c7897c15b109cba29ab0c4a791b6"
                }
            ],
            "title": "block: don't allow the same type rq_qos add more than once",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}