Use After Free in Linux
CVE-2022-49168
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not clean up repair bio if submit fails The submit helper will always run bio_endio() on the bio if it fails to submit, so cleaning up the bio just leads to a variety of use-after-free and NULL pointer dereference bugs because we race with the endio function that is cleaning up the bio. Instead just return BLK_STS_OK as the repair function has to continue to process the rest of the pages, and the endio for the repair bio will do the appropriate cleanup for the page that it was given.
Vulnerability class: Use-After-Free
EPSS: 0.003 (21.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Linux — versions 6c387ab20db15f2bd448f7c508e2638101b16ea1, 3.18, 0
- Linux Linux_kernel
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2022-49168?
- CVE-2022-49168 is a high-severity vulnerability in Linux, classified under Use After Free. CVSS score: 7.8/10. Published 2025-02-26.
- How severe is CVE-2022-49168?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2022-49168 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.