---
id: CVE-2022-50329
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq

  Commit 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'")
  will access 'bic->bfqq' in bic_set_bfqq(), howev…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq

  Commit 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'")
  will access 'bic->bfqq' in bic_set_bfqq(), howev…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-416
  - CWE-825
vendor: linux
product: linux_kernel
affected:
  - linux_kernel = 5.15.86
  - linux_kernel = 6.0.16
  - linux_kernel = 6.1.2
  - linux_kernel = 6.2
published: '2025-09-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:17:30.263'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-50329'
references:
  - url: 'https://git.kernel.org/stable/c/1425f1bb5df5239021fd09ebc2a5e8070e705d36'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/1ed959fef5b1c6f1a7a3fbea543698c30ebd6678'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/246cf66e300b76099b5dbd3fdd39e9a5dbc53f02'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7949b0df3dd9f4817ed4a4e989fa9ee81df6205f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cfe5b38c37720313eff0dec5517442c7ab3c9a20'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50329.json
  - url: 'https://access.redhat.com/security/cve/CVE-2022-50329'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2395242'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2022-50329'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-50329'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2025091554-CVE-2022-50329-58ac@gregkh/T
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00169
epssPercentile: 0.06247
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:31:01.622731Z'
scores:
  nvd: 7.8
  vendor: 6.7
  cna: 7.8
ingestedAt: '2026-10-15T21:45:11.281Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq

Commit 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'")
will access 'bic->bfqq' in bic_set_bfqq(), however, bfq_exit_icq_bfqq()
can free bfqq first, and then call bic_set_bfqq(), which will cause uaf.

Fix the problem by moving bfq_exit_bfqq() behind bic_set_bfqq().

## Affected

- `linux_kernel = 5.15.86`
- `linux_kernel = 6.0.16`
- `linux_kernel = 6.1.2`
- `linux_kernel = 6.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50329.json)