CVE-2022-49259

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
26/02/2025
Last modified:
21/10/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> block: don&amp;#39;t delete queue kobject before its children<br /> <br /> kobjects aren&amp;#39;t supposed to be deleted before their child kobjects are<br /> deleted. Apparently this is usually benign; however, a WARN will be<br /> triggered if one of the child kobjects has a named attribute group:<br /> <br /> sysfs group &amp;#39;modes&amp;#39; not found for kobject &amp;#39;crypto&amp;#39;<br /> WARNING: CPU: 0 PID: 1 at fs/sysfs/group.c:278 sysfs_remove_group+0x72/0x80<br /> ...<br /> Call Trace:<br /> sysfs_remove_groups+0x29/0x40 fs/sysfs/group.c:312<br /> __kobject_del+0x20/0x80 lib/kobject.c:611<br /> kobject_cleanup+0xa4/0x140 lib/kobject.c:696<br /> kobject_release lib/kobject.c:736 [inline]<br /> kref_put include/linux/kref.h:65 [inline]<br /> kobject_put+0x53/0x70 lib/kobject.c:753<br /> blk_crypto_sysfs_unregister+0x10/0x20 block/blk-crypto-sysfs.c:159<br /> blk_unregister_queue+0xb0/0x110 block/blk-sysfs.c:962<br /> del_gendisk+0x117/0x250 block/genhd.c:610<br /> <br /> Fix this by moving the kobject_del() and the corresponding<br /> kobject_uevent() to the correct place.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.16 (including) 4.19.238 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.20 (including) 5.4.189 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.5 (including) 5.10.110 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.11 (including) 5.15.33 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.16 (including) 5.16.19 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.17 (including) 5.17.2 (excluding)