CVE-2022-49465 is a high-severity use-after-free vulnerability in the Linux kernel's block layer throttling mechanism (blk-throttle). The vulnerability arises from improper handling of the BIO_THROTTLED flag in the blk_throtl_bio() function. When a block I/O (bio) operation is throttled, the kernel sets the BIO_THROTTLED flag and starts a timer to delay the submission of the bio. However, if the bio completes before the timer expires, the kernel may still attempt to access the bio after it has been freed, leading to a use-after-free condition. This is evidenced by the Kernel Address Sanitizer (KASAN) reports showing reads from freed memory addresses during bio processing. The root cause is that the BIO_THROTTLED flag is set outside the protection of the queue_lock, allowing a race condition where the bio can be freed concurrently. The fix involves moving the BIO_THROTTLED flag setting inside the queue_lock to prevent this race. The vulnerability affects Linux kernel versions identified by the commit hash 2a0f61e6ecd08d260054bde4b096ff207ce5350f and likely other versions containing the same flawed code. The CVSS 3.1 score is 7.8 (high), with attack vector local, low attack complexity, requiring privileges but no user interaction, and impacts confidentiality, integrity, and availability. Exploitation could allow a local attacker with some privileges to cause kernel memory corruption, potentially leading to privilege escalation, denial of service, or arbitrary code execution in kernel context. No known exploits are reported in the wild yet.

For European organizations, this vulnerability poses a significant risk especially for servers and infrastructure running Linux kernels with the affected blk-throttle code. Since Linux is widely used in enterprise environments, cloud providers, and critical infrastructure across Europe, exploitation could lead to system crashes, data corruption, or privilege escalation, undermining system integrity and availability. Organizations relying on Linux-based storage servers, virtualization hosts, or container platforms are particularly at risk. The vulnerability requires local access with some privileges, so insider threats or attackers who have gained limited access could leverage this flaw to escalate privileges or disrupt services. This could impact sectors such as finance, healthcare, government, and telecommunications, where Linux servers are prevalent and availability and data integrity are critical. The use-after-free nature also increases the risk of unpredictable kernel behavior, complicating incident response and recovery.

European organizations should prioritize patching Linux kernels to versions where this vulnerability is fixed, ensuring the BIO_THROTTLED flag is set under queue_lock protection. Since the vulnerability requires local privileges, organizations should enforce strict access controls and monitor for suspicious local activity. Employ kernel hardening techniques such as Kernel Address Sanitizer (KASAN) in testing environments to detect similar issues proactively. Limit the use of untrusted or unnecessary local accounts and implement robust privilege separation. For environments where immediate patching is not feasible, consider disabling or restricting blk-throttle features if possible, or isolating critical workloads to minimize exposure. Regularly audit kernel versions and configurations across infrastructure to identify vulnerable systems. Additionally, enhance logging and monitoring for kernel errors or crashes related to block I/O operations to detect potential exploitation attempts early.