CVE-2022-49720

block: Fix handling of offline queues in blk_mq_alloc_request_hctx()

State: Published
Severity: 7.8 High
Published: Feb 26, 2025
Updated: May 11, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

block: Fix handling of offline queues in blk_mq_alloc_request_hctx()

This patch prevents that test nvme/004 triggers the following:

UBSAN: array-index-out-of-bounds in block/blk-mq.h:135:9 index 512 is out of range for type 'long unsigned int [512]' Call Trace: show_stack+0x52/0x58 dump_stack_lvl+0x49/0x5e dump_stack+0x10/0x12 ubsan_epilogue+0x9/0x3b __ubsan_handle_out_of_bounds.cold+0x44/0x49 blk_mq_alloc_request_hctx+0x304/0x310 __nvme_submit_sync_cmd+0x70/0x200 [nvme_core] nvmf_connect_io_queue+0x23e/0x2a0 [nvme_fabrics] nvme_loop_connect_io_queues+0x8d/0xb0 [nvme_loop] nvme_loop_create_ctrl+0x58e/0x7d0 [nvme_loop] nvmf_create_ctrl+0x1d7/0x4d0 [nvme_fabrics] nvmf_dev_write+0xae/0x111 [nvme_fabrics] vfs_write+0x144/0x560 ksys_write+0xb7/0x140 __x64_sys_write+0x42/0x50 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-129 Improper Validation of Array Index

Affected Products

Product	Versions
LinuxLinux	20e4d813931961fe26d26a1e98b3aba6ec00b130 to before 7fa28a7c3d74933a4fc22d341b60927952f31c19Affected 20e4d813931961fe26d26a1e98b3aba6ec00b130 to before b5e65ef044d627effdc2599040b6d204e003f955Affected 20e4d813931961fe26d26a1e98b3aba6ec00b130 to before b202a0bd2580ee5b0453772c46d464152fafff73Affected 20e4d813931961fe26d26a1e98b3aba6ec00b130 to before 14dc7a18abbe4176f5626c13c333670da8e06aa1Affected
LinuxLinux	4.16Affected before 4.16Not affected 5.10.124 through 5.10.Not affected 5.15.49 through 5.15.Not affected 5.18.6 through 5.18.*Not affected 5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.