CVE-2022-50488 – This is a use-after-free vulnerability in the L... (How to Fix)

Q: What is the severity of CVE-2022-50488?

CVE-2022-50488 has a CVSS score of 7.8 (HIGH). This is a use-after-free vulnerability in the Linux kernel's BFQ I/O scheduler that allows local attackers to potentially crash the system or execute arbitrary code. It affects Linux systems using the BFQ scheduler when processes move between cgroups while I/O operations are in progress.

📋 TL;DR

This is a use-after-free vulnerability in the Linux kernel's BFQ I/O scheduler that allows local attackers to potentially crash the system or execute arbitrary code. It affects Linux systems using the BFQ scheduler when processes move between cgroups while I/O operations are in progress.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions with BFQ scheduler support, specifically mentioned in 5.10 but potentially other versions with similar code.

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if BFQ I/O scheduler is enabled and being used. Many distributions use other schedulers like CFQ or deadline by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to kernel-level code execution, leading to complete system compromise.

🟠

Likely Case

Kernel panic or system crash causing denial of service.

🟢

If Mitigated

System remains stable with no impact if patched or BFQ scheduler not used.

🌐 Internet-Facing: LOW - Requires local access to exploit.

🏢 Internal Only: MEDIUM - Local users or compromised accounts could exploit this vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and specific conditions: BFQ scheduler enabled, cgroup operations, and concurrent I/O operations.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patched in kernel commits: 094f3d9314d6, 5533742c7cb1, 64dc8c732f5c, 761564d93c82, b22fd72bfebd

Vendor Advisory: https://git.kernel.org/stable/c/094f3d9314d67691cb21ba091c1b528f6e3c4893

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable BFQ scheduler

linux

Switch to alternative I/O scheduler like CFQ or deadline

echo 'cfq' > /sys/block/[device]/queue/scheduler

Avoid cgroup process moves during I/O

linux

Implement policies to prevent moving processes between cgroups while they have active I/O operations

🧯 If You Can't Patch

Disable BFQ scheduler on all storage devices
Restrict local user access and monitor for suspicious cgroup operations

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if BFQ scheduler is active: cat /sys/block/sda/queue/scheduler | grep -q '\[bfq\]' && echo 'BFQ active'

Check Version:

uname -r

Verify Fix Applied:

Check kernel version is patched: uname -r should show version containing fixes from listed commits

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
KASAN reports of use-after-free in bfq_select_queue

SIEM Query:

kernel: "BUG: KASAN: use-after-free in bfq_select_queue" OR kernel: "bfqq->bic"

📊 Metadata

CVE ID: CVE-2022-50488

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.02% exploit probability (5.6th percentile)

Published: October 4, 2025

Last Updated: January 26, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-50488, you might also want to check these: