CVE-2022-49057: block: null_blk: end timed out poll request

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-26 · updated 2026-06-17
Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: block: null_blk: end timed out poll request When poll request is timed out, it is removed from the poll list, but not completed, so the request is leaked, and never get chance to complete. Fix the issue by ending it in timeout handler.

Affected products

Linux kernel: from 5.16 before 5.17.4; 5.18-rc1, 5.18-rc2 — fixed in 5.17.4

How to fix

Upgrade to a fixed version: Linux kernel 5.17.4. Check the vendor advisory for mitigations.

References

https://git.kernel.org/stable/c/3e3876d322aef82416ecc496a4d4a587e0fdf7a3
https://git.kernel.org/stable/c/407d09a22f3f685fd634aa5d05840c64b23bfebc

Get alerted when CVE-2022-49057 or the next vulnerability affects your stack