{
  "cveId": "CVE-2022-49901",
  "url": "https://patchblox.com/security/cve/CVE-2022-49901",
  "summary": "CVE-2022-49901 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49901, released May 1, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "blk-mq: Fix kmemleak in blk_mq_init_allocated_queue",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  blk-mq: Fix kmemleak in blk_mq_init_allocated_queue  There is a kmemleak caused by modprobe null_blk.ko  unreferenced object 0xffff8881acb1f000 (size 1024):   comm \u0022modprobe\u0022, pid 836, jiffies 4294971190 (age 27.068s)   hex dump (first 32 bytes):     00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00  .....N..........     ff ff ff ff ff ff ff ff 00 53 99 9e ff ff ff ff  .........S......   backtrace:     [\u003C000000004a10c249\u003E] kmalloc_node_trace\u002B0x22/0x60     [\u003C00000000648f7950\u003E] blk_mq_alloc_and_init_hctx\u002B0x289/0x350     [\u003C00000000af06de0e\u003E] blk_mq_realloc_hw_ctxs\u002B0x2fe/0x3d0     [\u003C00000000e00c1872\u003E] blk_mq_init_allocated_queue\u002B0x48c/0x1440     [\u003C00000000d16b4e68\u003E] __blk_mq_alloc_disk\u002B0xc8/0x1c0     [\u003C00000000d10c98c3\u003E] 0xffffffffc450d69d     [\u003C00000000b9299f48\u003E] 0xffffffffc4538392     [\u003C0000000061c39ed6\u003E] do_one_initcall\u002B0xd0/0x4f0     [\u003C00000000b389383b\u003E] do_init_module\u002B0x1a4/0x680     [\u003C0000000087cf3542\u003E] load_module\u002B0x6249/0x7110     [\u003C00000000beba61b8\u003E] __do_sys_finit_module\u002B0x140/0x200     [\u003C00000000fdcfff51\u003E] do_syscall_64\u002B0x35/0x80     [\u003C000000003c0f1f71\u003E] entry_SYSCALL_64_after_hwframe\u002B0x46/0xb0  That is because q-\u003Ema_ops is set to NULL before blk_release_queue is called.  blk_mq_init_queue_data   blk_mq_init_allocated_queue     blk_mq_realloc_hw_ctxs       for (i = 0; i \u003C set-\u003Enr_hw_queues; i\u002B\u002B) {         old_hctx = xa_load(\u0026q-\u003Ehctx_table, i);         if (!blk_mq_alloc_and_init_hctx(.., i, ..))\t\t[1]           if (!old_hctx) \t    break;        xa_for_each_start(\u0026q-\u003Ehctx_table, j, hctx, j)         blk_mq_exit_hctx(q, set, hctx, j); \t\t\t[2]      if (!q-\u003Enr_hw_queues)\t\t\t\t\t[3]       goto err_hctxs;    err_exit:       q-\u003Emq_ops = NULL;\t\t\t  \t\t\t[4]    blk_put_queue     blk_release_queue       if (queue_is_mq(q))\t\t\t\t\t[5]         blk_mq_release(q);  [1]: blk_mq_alloc_and_init_hctx failed at i != 0. [2]: The hctxs allocated by [1] are moved to q-\u003Eunused_hctx_list and will be cleaned up in blk_mq_release. [3]: q-\u003Enr_hw_queues is 0. [4]: Set q-\u003Emq_ops to NULL. [5]: queue_is_mq returns false due to [4]. And blk_mq_release will not be called. The hctxs in q-\u003Eunused_hctx_list are leaked.  To fix it, call blk_release_queue in exception path.",
  "published": "2025-05-01T15:16:15Z",
  "severity": "Moderate",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "cwe": "Missing Release of Memory after Effective Lifetime",
  "epss": 0.00172,
  "epssPercentile": 0.06583,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-49901",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.0.8-1",
      "fix": "DEBIAN-CVE-2022-49901",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49901",
      "released": "2025-05-01T15:16:15Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.0.8-1",
      "fix": "DEBIAN-CVE-2022-49901",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49901",
      "released": "2025-05-01T15:16:15Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.0.8-1",
      "fix": "DEBIAN-CVE-2022-49901",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49901",
      "released": "2025-05-01T15:16:15Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}