CVE-2022-49406 block: Fix potential deadlock in blk_ia_range_sysfs_show()
A potential deadlock in the Linux kernel block layer can cause a system hang during device removal, requiring a kernel patch to resolve.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-49406?
CVE-2022-49406 is a medium-severity vulnerability in Linux kernel, published on 26 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
block: Fix potential deadlock in blk_ia_range_sysfs_show()
When being read, a sysfs attribute is already protected against removal with the kobject node active reference counter. As a result, in blk_ia_range_sysfs_show(), there is no need to take the queue sysfs lock when reading the value of a range attribute. Using the queue sysfs lock in this function creates a potential deadlock situation with the disk removal, something that a lockdep signals with a splat when the device is removed:
[ 760.703551] Possible unsafe locking scenario: [ 760.703551] [ 760.703554] CPU0 CPU1 [ 760.703556] ---- ---- [ 760.703558] lock(&q->sysfs_lock); [ 760.703565] lock(kn->active#385); [ 760.703573] lock(&q->sysfs_lock); [ 760.703579] lock(kn->active#385); [ 760.703587] [ 760.703587] *** DEADLOCK ***
Solve this by removing the mutex_lock()/mutex_unlock() calls from blk_ia_range_sysfs_show().
Weakness: CWE-667
Which versions are affected by CVE-2022-49406?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-49406?
Apply the vendor's patch.
Is CVE-2022-49406 being exploited?
There is no known exploitation of CVE-2022-49406 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-49406, GHSA-x74c-mr6j-xgx9, UBUNTU-CVE-2022-49406.