{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-50064", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-06-18T10:57:27.405Z", "datePublished": "2025-06-18T11:02:11.276Z", "dateUpdated": "2026-08-05T08:57:17.403Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:57:17.403Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-blk: Avoid use-after-free on suspend/resume\n\nhctx->user_data is set to vq in virtblk_init_hctx(). However, vq is\nfreed on suspend and reallocated on resume. So, hctx->user_data is\ninvalid after resume, and it will cause use-after-free accessing which\nwill result in the kernel crash something like below:\n\n[ 22.428391] Call Trace:\n[ 22.428899] \n[ 22.429339] virtqueue_add_split+0x3eb/0x620\n[ 22.430035] ? __blk_mq_alloc_requests+0x17f/0x2d0\n[ 22.430789] ? kvm_clock_get_cycles+0x14/0x30\n[ 22.431496] virtqueue_add_sgs+0xad/0xd0\n[ 22.432108] virtblk_add_req+0xe8/0x150\n[ 22.432692] virtio_queue_rqs+0xeb/0x210\n[ 22.433330] blk_mq_flush_plug_list+0x1b8/0x280\n[ 22.434059] __blk_flush_plug+0xe1/0x140\n[ 22.434853] blk_finish_plug+0x20/0x40\n[ 22.435512] read_pages+0x20a/0x2e0\n[ 22.436063] ? folio_add_lru+0x62/0xa0\n[ 22.436652] page_cache_ra_unbounded+0x112/0x160\n[ 22.437365] filemap_get_pages+0xe1/0x5b0\n[ 22.437964] ? context_to_sid+0x70/0x100\n[ 22.438580] ? sidtab_context_to_sid+0x32/0x400\n[ 22.439979] filemap_read+0xcd/0x3d0\n[ 22.440917] xfs_file_buffered_read+0x4a/0xc0\n[ 22.441984] xfs_file_read_iter+0x65/0xd0\n[ 22.442970] __kernel_read+0x160/0x2e0\n[ 22.443921] bprm_execve+0x21b/0x640\n[ 22.444809] do_execveat_common.isra.0+0x1a8/0x220\n[ 22.446008] __x64_sys_execve+0x2d/0x40\n[ 22.446920] do_syscall_64+0x37/0x90\n[ 22.447773] entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nThis patch fixes this issue by getting vq from vblk, and removes\nvirtblk_init_hctx()." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The UAF is reached through local block I/O on a virtio-blk device (e.g. plugged reads during execve/filemap), via syscalls on the local system rather than network or physical device input.\nAC:L - After freeze/restore, hctx->driver_data permanently refers to the freed vqs allocation and any subsequent queue_rqs/poll path use is reliably a UAF with no race the attacker must win; suspend/resume is a normal operational state on virtio guests (laptops/Chromebooks/VMs).\nPR:L - System sleep setup may be privileged, but once resumed any unprivileged local user can trigger the stale driver_data path via ordinary filesystem I/O or execve on a virtio-blk-backed volume, as shown in the crash trace.\nUI:N - The attacker triggers the vulnerable I/O path themselves after resume; no separate victim action is required to exploit the UAF.\nS:U - Impact is confined to the same kernel authority running virtio-blk (local privilege escalation / memory corruption in that kernel), not a guest-to-host or other cross-boundary escape.\nC:H - This is a use-after-free of virtio_blk_vq/virtqueue state; per kernel UAF guidance that enables heap reuse and arbitrary read primitives.\nI:H - The same UAF of queue/virtqueue objects can be leveraged via heap spraying for arbitrary write and control-flow hijacking.\nA:H - The bug demonstrably causes a kernel oops/crash on post-resume I/O, and UAFs retain High availability impact even when not fully exploited for code execution." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/block/virtio_blk.c" ], "versions": [ { "version": "4e0400525691d0e676dbe002641f9a61261f1e1b", "lessThan": "2b54e14535bc34bf649372060d518ec9f2b893b3", "status": "affected", "versionType": "git" }, { "version": "4e0400525691d0e676dbe002641f9a61261f1e1b", "lessThan": "8d12ec10292877751ee4463b11a63bd850bc09b5", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/block/virtio_blk.c" ], "versions": [ { "version": "5.19", "status": "affected" }, { "version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver" }, { "version": "5.19.4", "lessThanOrEqual": "5.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "5.19.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/2b54e14535bc34bf649372060d518ec9f2b893b3" }, { "url": "https://git.kernel.org/stable/c/8d12ec10292877751ee4463b11a63bd850bc09b5" } ], "title": "virtio-blk: Avoid use-after-free on suspend/resume", "x_generator": { "engine": "bippy-1.2.0" } } } }