CVE-2022-50064: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50064 is a use-after-free vulnerability in the Linux kernel's virtio-blk driver that occurs during suspend and resume operations. The flaw affects Linux kernel versions 5.19 through 5.19.3, with version 5.19.4 containing the fix. It was published on June 18, 2025, and carries a CVSS v3.1 base score of 7.8 (High) (Feedly).

The root cause (CWE-416: Use After Free) lies in the virtio-blk driver's virtblk_init_hctx() function, which sets hctx->user_data to a pointer to the virtqueue (vq). During a system suspend, the virtqueue is freed; upon resume, it is reallocated at a potentially different address, but hctx->user_data still holds the stale pointer. Any subsequent I/O operation that dereferences this pointer — such as virtqueue_add_split() called during block I/O — accesses freed memory, triggering a kernel crash. The attack vector is local, requires only low privileges, and has low complexity, with no user interaction needed (Feedly).

Successful exploitation can result in a kernel crash (denial of service) or, in more severe scenarios, arbitrary code execution at the kernel level, yielding full system compromise. The vulnerability has high impacts on confidentiality, integrity, and availability, as kernel-level code execution grants an attacker unrestricted access to all system resources, memory, and data (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

Update the Linux kernel to version 5.19.4 or later, which contains the upstream fix addressing the stale hctx->user_data pointer during suspend/resume cycles. Two upstream patches are available in the stable kernel tree (Kernel Patch 1, Kernel Patch 2). Systems running kernel versions 5.19 through 5.19.3 with virtio-blk devices that undergo suspend/resume cycles should be prioritized for patching. As a temporary workaround where patching is not immediately possible, avoiding suspend/resume operations on affected systems can reduce exposure.