CVE-2022-50530 blk-mq: fix null pointer dereference in blk_mq_clear_rq_mapping()
A null pointer dereference in the Linux kernel block layer can cause a system crash, requiring a kernel patch to resolve.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50530?
CVE-2022-50530 is a medium-severity vulnerability in Linux kernel, published on 7 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
blk-mq: fix null pointer dereference in blk_mq_clear_rq_mapping()
Our syzkaller report a null pointer dereference, root cause is following:
__blk_mq_alloc_map_and_rqs set->tags[hctx_idx] = blk_mq_alloc_map_and_rqs blk_mq_alloc_map_and_rqs blk_mq_alloc_rqs // failed due to oom alloc_pages_node // set->tags[hctx_idx] is still NULL blk_mq_free_rqs drv_tags = set->tags[hctx_idx]; // null pointer dereference is triggered blk_mq_clear_rq_mapping(drv_tags, ...)
This is because commit 63064be150e4 ("blk-mq: Add blk_mq_alloc_map_and_rqs()") merged the two steps:
1) set->tags[hctx_idx] = blk_mq_alloc_rq_map() 2) blk_mq_alloc_rqs(..., set->tags[hctx_idx])
into one step:
set->tags[hctx_idx] = blk_mq_alloc_map_and_rqs()
Since tags is not initialized yet in this case, fix the problem by checking if tags is NULL pointer in blk_mq_clear_rq_mapping().
Weakness: CWE-476
Which versions are affected by CVE-2022-50530?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-50530?
Apply the vendor's patch.
Is CVE-2022-50530 being exploited?
There is no known exploitation of CVE-2022-50530 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-50530, GHSA-g6cv-6crr-3rp7, UBUNTU-CVE-2022-50530.