{
  "cveId": "CVE-2022-49377",
  "url": "https://patchblox.com/security/cve/CVE-2022-49377",
  "summary": "CVE-2022-49377 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49377, released February 26, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  blk-mq: don\u0027t touch -\u003Etagset in blk_mq_get_sq_hc...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  blk-mq: don\u0027t touch -\u003Etagset in blk_mq_get_sq_hctx  blk_mq_run_hw_queues() could be run when there isn\u0027t queued request and after queue is cleaned up, at that time tagset is freed, because tagset lifetime is covered by driver, and often freed after blk_cleanup_queue() returns.  So don\u0027t touch -\u003Etagset for figuring out current default hctx by the mapping built in request queue, so use-after-free on tagset can be avoided. Meantime this way should be fast than retrieving mapping from tagset.",
  "published": "2025-02-26T07:01:14Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00288,
  "epssPercentile": 0.2141,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.18.5-1",
      "fix": "DEBIAN-CVE-2022-49377",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49377",
      "released": "2025-02-26T07:01:14Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.18.5-1",
      "fix": "DEBIAN-CVE-2022-49377",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49377",
      "released": "2025-02-26T07:01:14Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.18.5-1",
      "fix": "DEBIAN-CVE-2022-49377",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49377",
      "released": "2025-02-26T07:01:14Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}