CVE-2022-49266 is a vulnerability in the Linux kernel's block layer related to the request queue quality of service (rq-qos) subsystem. The issue stems from a code change (commit a647a524a467) that modified bio_endio() to skip calling rq_qos_done_bio() when the BIO_TRACKED flag was not set on a bio (block I/O operation). This change fixed a potential kernel oops but inadvertently broke the blk-iocost controller's accounting logic. Specifically, merged bios that do not have BIO_TRACKED set were never passed to rq_qos_done_bio(), causing them to be considered perpetually in-flight. This leads to a failure mode where intermediate cgroups remain stuck active, preventing their child cgroups from activating due to the leaf-only rule, resulting in loss of I/O control and isolation. The vulnerability impacts the blk-iocost cgroup controller, which is used to isolate and control I/O bandwidth and latency for workloads. The issue was demonstrated using a memory hog scenario benchmark (resctl-bench) on a Samsung SSD 970 PRO 512GB device, showing significant degradation in isolation and increased I/O latency. The fix introduced a new BIO_QOS_MERGED flag to mark merged bios and ensured rq_qos_done_bio() is called for them as well. Additionally, BIO_TRACKED was renamed to BIO_QOS_THROTTLED for clarity. After applying the patch, benchmarks showed a marked improvement in isolation and latency metrics, restoring expected I/O control behavior. This vulnerability does not cause direct data corruption or kernel crashes but degrades the effectiveness of I/O resource control, potentially allowing noisy or malicious workloads to impact the performance isolation guarantees of other workloads on the same system. It affects Linux kernel versions containing the specified commits prior to the patch. No known exploits in the wild have been reported. No CVSS score is assigned yet.

For European organizations relying on Linux servers, especially those using cgroup blk-iocost controllers to enforce I/O resource isolation (common in multi-tenant environments, cloud providers, and container orchestration platforms), this vulnerability can lead to degraded performance isolation. This means that a high I/O load or malicious workload could cause intermediate cgroups to remain stuck active, preventing proper activation of child cgroups and resulting in loss of control over I/O bandwidth allocation. Consequently, critical applications or services could experience increased latency or reduced throughput, impacting service quality and potentially violating SLAs. While this does not directly compromise confidentiality or integrity, the availability and reliability of services could be negatively affected. This is particularly relevant for data centers, cloud providers, and enterprises running mixed workloads on Linux infrastructure. The impact is more pronounced on systems using the blk-iocost controller with cgroup v2 and on high-performance NVMe SSDs where precise I/O control is critical.

European organizations should promptly apply the Linux kernel patch that introduces the BIO_QOS_MERGED flag and corrects the rq_qos_done_bio() callback behavior. Specifically: 1. Identify Linux kernel versions in use and verify if they include the vulnerable commits (notably a647a524a467 and related). 2. Upgrade to a patched kernel version where this vulnerability is fixed. 3. For environments using cgroup blk-iocost controllers, validate I/O isolation behavior post-patch with benchmarks similar to resctl-bench to ensure proper functionality. 4. Monitor cgroup states and I/O latency metrics to detect anomalies indicative of stuck cgroups or degraded isolation. 5. In containerized or virtualized environments, ensure orchestration platforms and host OS kernels are updated to prevent cross-tenant performance interference. 6. Consider implementing additional monitoring and alerting on I/O performance metrics to detect potential exploitation or performance degradation early. These steps go beyond generic advice by focusing on the specific subsystem affected and the operational context where the vulnerability manifests.