CVE-2022-49384

md: fix double free of io_acct_set bioset

State: Published
Severity: 7.8 High
Published: Feb 26, 2025
Updated: May 23, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

md: fix double free of io_acct_set bioset

Now io_acct_set is alloc and free in personality. Remove the codes that free io_acct_set in md_free and md_stop.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-415 Double Free

Affected Products

Product	Versions
LinuxLinux	00e3d58f50a875343124bcf5a9637520a492b0d1 to before 36a2fc44c574a59ee3b5e2cb327182f227b2b07eAffected 0c031fd37f69deb0cd8c43bbfcfccd62ebd7e952 to before f99d5b5dc8a42c807b5f1176b925aa45d61962abAffected 0c031fd37f69deb0cd8c43bbfcfccd62ebd7e952 to before ea7d7bd90079d96f9c86bdaf0b106e0cd2a70661Affected 0c031fd37f69deb0cd8c43bbfcfccd62ebd7e952 to before 42b805af102471f53e3c7867b8c2b502ea4eef7eAffected 92053ae0398a58c6914e807d5e070297ba8cfe88Affected 5.15.17 to before 5.15.46Affected 5.16.3 to before 5.17Affected
LinuxLinux	5.17Affected before 5.17Not affected 5.15.46 through 5.15.Not affected 5.17.14 through 5.17.Not affected 5.18.3 through 5.18.*Not affected 5.19 and laterNot affected

Product

Versions

LinuxLinux

00e3d58f50a875343124bcf5a9637520a492b0d1 to before 36a2fc44c574a59ee3b5e2cb327182f227b2b07eAffected
0c031fd37f69deb0cd8c43bbfcfccd62ebd7e952 to before f99d5b5dc8a42c807b5f1176b925aa45d61962abAffected
0c031fd37f69deb0cd8c43bbfcfccd62ebd7e952 to before ea7d7bd90079d96f9c86bdaf0b106e0cd2a70661Affected
0c031fd37f69deb0cd8c43bbfcfccd62ebd7e952 to before 42b805af102471f53e3c7867b8c2b502ea4eef7eAffected
92053ae0398a58c6914e807d5e070297ba8cfe88Affected
5.15.17 to before 5.15.46Affected
5.16.3 to before 5.17Affected

LinuxLinux

5.17Affected
before 5.17Not affected
5.15.46 through 5.15.*Not affected
5.17.14 through 5.17.*Not affected
5.18.3 through 5.18.*Not affected
5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.