CVE-2022-48846

What it actually does

Memory leak of rq_qos structures occurs when blk_cleanup_queue() is called on request queues without an associated disk, because rq_qos_exit() was moved exclusively into del_gendisk().

Why it matters to the business

Prolonged operation on affected Linux kernels can exhaust kernel memory, leading to performance degradation or crashes on systems using block devices such as un-present SCSI LUNs or NVMe admin queues; high ecosystem prevalence increases exposure across servers and embedded devices.

How an attack unfolds

An attacker with local access repeatedly triggers creation of request queues lacking disks (for example via specific storage configurations) to accumulate leaked rq_qos memory until system resources are exhausted; no named threat actors or ransomware campaigns are associated.

How to fix it

Apply the upstream fix commit d4ad8736ac982111bb0be8306bf19c8207f6600e or later; update to a patched Linux kernel version that restores rq_qos_exit() in blk_cleanup_queue() or moves blkcg_init/exit handling into disk allocation paths.

How to confirm the fix worked

Confirm kernel source contains the rq_qos_exit() call in blk_cleanup_queue(); monitor memory usage of block layer structures under load that previously triggered the leak; verify no growth in rq_qos allocations after repeated queue creation without disks.

Typical attack path

1. Obtain local access or execute code on the target Linux system
2. Trigger repeated allocation of request queues without disks
3. Allow rq_qos structures to leak without release
4. Monitor until memory pressure causes denial of service

How to detect it

Review kernel memory statistics and slab allocator usage for rq_qos related objects; examine dmesg or kernel logs for repeated queue initialization without corresponding disk attachment events over extended periods.

What your security team should do

• Prioritize patching Linux kernel instances exposed to block device workloads within standard maintenance windows
• Audit systems for custom storage configurations that create diskless queues
• Monitor kernel memory statistics for unexplained growth in block layer allocations