{"id":"CVE-2022-50086","title":"block: don't allow the same type rq_qos add more than once","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nblock: don't allow the same type rq_qos add more than once\n\nIn our test of iocost, we encountered some list add/del corruptions of\ninner_walk list in ioc_timer_fn.\n\nThe…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= a79050434b45959f397042080fd1d70ffa9bd9df < 0b7f5d7a4d2a72ad9de04ab8ccba2a31904aa638","Linux >= a79050434b45959f397042080fd1d70ffa9bd9df < 08ef66e800a85afc6b54cb95841f6502627eee2e","Linux >= a79050434b45959f397042080fd1d70ffa9bd9df < 0c9bb1acd1d103a3070b2126870eb52761d606ce","Linux >= a79050434b45959f397042080fd1d70ffa9bd9df < 14a6e2eb7df5c7897c15b109cba29ab0c4a791b6","Linux 4.19"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T19:54:13.391019Z"},"published":"2025-06-18","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:00:16.456Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2022-50086","references":[{"url":"https://git.kernel.org/stable/c/0b7f5d7a4d2a72ad9de04ab8ccba2a31904aa638"},{"url":"https://git.kernel.org/stable/c/08ef66e800a85afc6b54cb95841f6502627eee2e"},{"url":"https://git.kernel.org/stable/c/0c9bb1acd1d103a3070b2126870eb52761d606ce"},{"url":"https://git.kernel.org/stable/c/14a6e2eb7df5c7897c15b109cba29ab0c4a791b6"}],"tags":["cve.org"],"epss":0.00193,"epssPercentile":0.09015,"ingestedAt":"2026-11-05T22:38:31.650Z","slug":"CVE-2022-50086","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblock: don't allow the same type rq_qos add more than once\n\nIn our test of iocost, we encountered some list add/del corruptions of\ninner_walk list in ioc_timer_fn.\n\nThe reason can be described as follows:\n\ncpu 0\t\t\t\t\tcpu 1\nioc_qos_write\t\t\t\tioc_qos_write\n\nioc = q_to_ioc(queue);\nif (!ioc) {\n        ioc = kzalloc();\n\t\t\t\t\tioc = q_to_ioc(queue);\n\t\t\t\t\tif (!ioc) {\n\t\t\t\t\t\tioc = kzalloc();\n\t\t\t\t\t\t...\n\t\t\t\t\t\trq_qos_add(q, rqos);\n\t\t\t\t\t}\n        ...\n        rq_qos_add(q, rqos);\n        ...\n}\n\nWhen the io.cost.qos file is written by two cpus concurrently, rq_qos may\nbe added to one disk twice. In that case, there will be two iocs enabled\nand running on one disk. They own different iocgs on their active list. In\nthe ioc_timer_fn function, because of the iocgs from two iocs have the\nsame root iocg, the root iocg's walk_list may be overwritten by each other\nand this leads to list add/del corruptions in building or destroying the\ninner_walk list.\n\nAnd so far, the blk-rq-qos framework works in case that one instance for\none type rq_qos per queue by default. This patch make this explicit and\nalso fix the crash above.\n\n## Affected\n\n- `Linux >= a79050434b45959f397042080fd1d70ffa9bd9df < 0b7f5d7a4d2a72ad9de04ab8ccba2a31904aa638`\n- `Linux >= a79050434b45959f397042080fd1d70ffa9bd9df < 08ef66e800a85afc6b54cb95841f6502627eee2e`\n- `Linux >= a79050434b45959f397042080fd1d70ffa9bd9df < 0c9bb1acd1d103a3070b2126870eb52761d606ce`\n- `Linux >= a79050434b45959f397042080fd1d70ffa9bd9df < 14a6e2eb7df5c7897c15b109cba29ab0c4a791b6`\n- `Linux 4.19`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}