{
  "threat_severity" : "Low",
  "public_date" : "2025-05-01T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: block: Fix possible memory leak for rq_wb on add_disk failure",
    "id" : "2363385",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2363385"
  },
  "cvss3" : {
    "cvss3_base_score" : "4.4",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
    "status" : "verified"
  },
  "cwe" : "CWE-401",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nblock: Fix possible memory leak for rq_wb on add_disk failure\nkmemleak reported memory leaks in device_add_disk():\nkmemleak: 3 new suspected memory leaks\nunreferenced object 0xffff88800f420800 (size 512):\ncomm \"modprobe\", pid 4275, jiffies 4295639067 (age 223.512s)\nhex dump (first 32 bytes):\n04 00 00 00 08 00 00 00 01 00 00 00 00 00 00 00  ................\n00 e1 f5 05 00 00 00 00 00 00 00 00 00 00 00 00  ................\nbacktrace:\n[<00000000d3662699>] kmalloc_trace+0x26/0x60\n[<00000000edc7aadc>] wbt_init+0x50/0x6f0\n[<0000000069601d16>] wbt_enable_default+0x157/0x1c0\n[<0000000028fc393f>] blk_register_queue+0x2a4/0x420\n[<000000007345a042>] device_add_disk+0x6fd/0xe40\n[<0000000060e6aab0>] nbd_dev_add+0x828/0xbf0 [nbd]\n...\nIt is because the memory allocated in wbt_enable_default() is not\nreleased in device_add_disk() error path.\nNormally, these memory are freed in:\ndel_gendisk()\nrq_qos_exit()\nrqos->ops->exit(rqos);\nwbt_exit()\nSo rq_qos_exit() is called to free the rq_wb memory for wbt_init().\nHowever in the error path of device_add_disk(), only\nblk_unregister_queue() is called and make rq_wb memory leaked.\nAdd rq_qos_exit() to the error path to fix it." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2023-05-09T00:00:00Z",
    "advisory" : "RHSA-2023:2458",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-284.11.1.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2023-05-09T00:00:00Z",
    "advisory" : "RHSA-2023:2458",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-284.11.1.el9_2"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2022-49902\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-49902\nhttps://lore.kernel.org/linux-cve-announce/2025050102-CVE-2022-49902-59fe@gregkh/T" ],
  "name" : "CVE-2022-49902",
  "csaw" : false
}