5.5

CVE-2022-49297: nbd: fix io hung while disconnecting device

Analyzed
AliasesUBUNTU-CVE-2022-49297DEBIAN-CVE-2022-49297
Published 26-02-2025Last modified 11-05-2026

Vulnerability summary

CVE-2022-49297 is a medium (CVSS 5.5) vulnerability in linux. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 21% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.28%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8 · Related 7
RHSA-2022:8267SUSE-SU-2025:1027-1SUSE-SU-2025:1176-1SUSE-SU-2025:1183-1SUSE-SU-2025:1194-1SUSE-SU-2025:1241-1

Timeline

  1. 26-02-2025
    PublishedVulnerability first disclosed.
  2. 11-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: nbd: fix io hung while disconnecting device In our tests, "qemu-nbd" triggers a io hung: INFO: task qemu-nbd:11445 blocked for more than 368 seconds. Not tainted 5.18.0-rc3-next-20220422-00003-g2176915513ca #884 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:qemu-nbd state:D stack: 0 pid:11445 ppid: 1 flags:0x00000000 Call Trace: <TASK> __schedule+0x480/0x1050 ? _raw_spin_lock_irqsave+0x3e/0xb0 schedule+0x9c/0x1b0 blk_mq_freeze_queue_wait+0x9d/0xf0 ? ipi_rseq+0x70/0x70 blk_mq_freeze_queue+0x2b/0x40 nbd_add_socket+0x6b/0x270 [nbd] nbd_ioctl+0x383/0x510 [nbd] blkdev_ioctl+0x18e/0x3e0 __x64_sys_ioctl+0xac/0x120 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fd8ff706577 RSP: 002b:00007fd8fcdfebf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000040000000 RCX: 00007fd8ff706577 RDX: 000000000000000d RSI: 000000000000ab00 RDI: 000000000000000f RBP: 000000000000000f R08: 000000000000fbe8 R09: 000055fe497c62b0 R10: 00000002aff20000 R11: 0000000000000246 R12: 000000000000006d R13: 0000000000000000 R14: 00007ffe82dc5e70 R15: 00007fd8fcdff9c0 "qemu-ndb -d" will call ioctl 'NBD_DISCONNECT' first, however, following message was found: block nbd0: Send disconnect failed -32 Which indicate that something is wrong with the server. Then, "qemu-nbd -d" will call ioctl 'NBD_CLEAR_SOCK', however ioctl can't clear requests after commit 2516ab1543fd("nbd: only clear the queue on device teardown"). And in the meantime, request can't complete through timeout because nbd_xmit_timeout() will always return 'BLK_EH_RESET_TIMER', which means such request will never be completed in this situation. Now that the flag 'NBD_CMD_INFLIGHT' can make sure requests won't complete multiple times, switch back to call nbd_clear_sock() in nbd_clear_sock_ioctl(), so that inflight requests can be cleared.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.28%

Chance of exploitation in the next 30 days

Percentile

21%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.28% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu111 products
  • linuxAll versions (No fix recorded) | < 4.15.0-192.203 | < 5.4.0-125.141 | < 5.15.0-43.46
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 4.15.0-1140.151 | < 5.4.0-1084.91 | < 5.15.0-1017.21
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 2516ab1543fdd1f9d08385d73cae51f668a9f3dc, < 67e403136a0e1a55fef6a05f103a3979a39ad3fd | ≥ 2516ab1543fdd1f9d08385d73cae51f668a9f3dc, < 62d227f67a8c25d5e16f40e5290607f9306d2188 | ≥ 2516ab1543fdd1f9d08385d73cae51f668a9f3dc, < 69893d6d7f5c10d8306c1b5fc64b71efc91aa6cd | ≥ 2516ab1543fdd1f9d08385d73cae51f668a9f3dc, < f72df77600a43e59b3189e53b47f8685739867d3 | ≥ 2516ab1543fdd1f9d08385d73cae51f668a9f3dc, < c4ba982bd5084fa659ef518aaf159e4dab02ecda | ≥ 2516ab1543fdd1f9d08385d73cae51f668a9f3dc, < 54b06dc2a206b4d67349bb56b92d4bd32700b7b1 | ≥ 2516ab1543fdd1f9d08385d73cae51f668a9f3dc, < 141318e62db87105b0103fccc59c9c5940da248d | ≥ 2516ab1543fdd1f9d08385d73cae51f668a9f3dc, < 09dadb5985023e27d4740ebd17e6fea4640110e5 | 4.12
  • linux_kernel< 4.14.283 | ≥ 4.15, < 4.19.247 | ≥ 4.20, < 5.4.198 | ≥ 5.5, < 5.10.122 | ≥ 5.11, < 5.15.47 | ≥ 5.16, < 5.17.15 | ≥ 5.18, < 5.18.4
Debian1 product
  • linux< 5.18.5-1

3 vendors · 114 products

References

12 links
Show all 12 references