Double Queue Request Issue in Linux Kernel Affecting Various Drivers

CVE-2022-50554

What is CVE-2022-50554?

A vulnerability has been identified in the Linux kernel related to block I/O processing. This issue occurs in scenarios with virtual machines, where long VM exit latencies or preempt latencies of vCPU threads can lead to a premature timeout of block I/O requests. The problematic behavior arises during the request queueing phase, potentially causing double queue requests and resulting in a kernel panic. The onus is typically on drivers to manage the race conditions between timeouts and completions. However, given the widespread nature of this problem, many drivers could be affected, making it challenging to implement a fix. A proposed patch aims to prevent this issue by ensuring that ongoing requests are appropriately drained before a new queued request is initiated.

References