CVE-2022-50064: 
Linux Kernel vulnerability analysis and mitigation

A use-after-free vulnerability (CVE-2022-50064) was discovered in the Linux kernel's virtio-blk subsystem. The issue occurs during suspend/resume operations where hctx->user_data is set to vq in virtblk_init_hctx(). The vulnerability was identified when vq is freed on suspend and reallocated on resume, causing hctx->user_data to become invalid after resume (NVD, Wiz).

The vulnerability manifests when accessing the invalid hctx->user_data after system resume, which results in a use-after-free condition. This can trigger a kernel crash with a call trace involving functions such as virtqueue_add_split, virtqueue_add_sgs, and virtblk_add_req. The issue was resolved by modifying how vq is obtained from vblk and removing virtblk_init_hctx() (NVD, Wiz).

When exploited, this vulnerability results in a kernel crash, potentially causing system instability and denial of service. The crash occurs during operations involving the virtio block device driver, affecting system reliability (Wiz).

The issue has been fixed in the Linux kernel by modifying how vq is obtained from vblk and removing virtblk_init_hctx(). Users should update to a patched version of the kernel that includes this fix (Wiz).