CVE-2022-50086: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50086 is a race condition vulnerability in the Linux kernel's block layer I/O cost (iocost) subsystem that can cause list corruption and system crashes. When two CPUs concurrently write to the io.cost.qos cgroup file, a time-of-check/time-of-use race allows two separate ioc (I/O cost controller) instances to be registered for the same disk queue, leading to linked-list corruption in ioc_timer_fn. The vulnerability affects Linux kernel versions before 5.15.61, 5.16.x through 5.18.x before 5.18.18, and 5.19.x before 5.19.2. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a classic TOCTOU race condition (CWE-362) in the ioc_qos_write function of the Linux kernel's blk-rq-qos framework. When two CPUs simultaneously check whether an ioc instance exists for a given queue (q_to_ioc(queue) returns NULL for both), each allocates a new ioc and calls rq_qos_add(), resulting in two ioc instances registered on the same disk. Because both ioc instances maintain separate active lists of I/O cost groups (iocg) but share the same root iocg, the inner_walk list in ioc_timer_fn can be overwritten by each instance, causing list add/delete corruptions. The fix enforces that only one instance of a given rq_qos type may be registered per queue (Feedly, Kernel Patch).

Successful exploitation causes kernel list corruption that can lead to system crashes (denial of service) or unpredictable kernel behavior. The impact is limited to availability — there is no confidentiality or integrity impact — but a crash of the kernel affects all workloads on the affected host. A local user with write access to the io.cost.qos cgroup file can trigger this condition, making it relevant in multi-tenant or container environments where cgroup file access is granted to non-root users (Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting very low probability of exploitation in the near term. Exploitation requires local access and the ability to write to the io.cost.qos cgroup file, which significantly limits the attack surface (Feedly).

1. Gain local access: Obtain a local user account on a system running a vulnerable Linux kernel (< 5.15.61, 5.16–5.18.x < 5.18.18, or 5.19.x < 5.19.2) with write access to the io.cost.qos cgroup v2 file for a target block device.
2. Identify the target cgroup path: Locate the relevant cgroup path, e.g., /sys/fs/cgroup/io.cost.qos, associated with a disk that has iocost enabled.
3. Trigger concurrent writes: Launch two or more threads or processes that simultaneously write to the io.cost.qos file (e.g., using a shell script with background jobs or a multithreaded C program calling write() concurrently).
4. Race condition triggers double registration: If the race is won, both threads pass the q_to_ioc() NULL check simultaneously, each allocating a new ioc and calling rq_qos_add(), registering two ioc instances on the same queue.
5. Kernel crash or corruption: The ioc_timer_fn function subsequently corrupts the inner_walk linked list due to conflicting iocg root pointers, resulting in a kernel panic or silent memory corruption (Feedly).

• Logs: Kernel oops or panic messages in /var/log/kern.log or dmesg referencing ioc_timer_fn, list_add corruption, or list_del corruption in the block layer.
• Logs: BUG or WARNING traces involving blk-rq-qos, iocg, or rq_qos_add in kernel ring buffer output (dmesg | grep -i 'list_add\|list_del\|ioc_timer').
• Process: Unusual concurrent write activity to /sys/fs/cgroup/io.cost.qos from multiple processes or threads in a short time window, visible via inotifywait or auditd file access logs.
• System: Unexpected system reboots or kernel panics on hosts with iocost-enabled block devices, particularly under I/O-intensive workloads (Feedly).

Upgrade to a patched Linux kernel version: 5.15.61 or later (for the 5.15 stable branch), 5.18.18 or later (for the 5.18 branch), or 5.19.2 or later (for the 5.19 branch). Patches have been committed to the Linux kernel stable repository across four commits. As a workaround where patching is not immediately possible, restrict write access to the io.cost.qos cgroup file to prevent unprivileged or concurrent user access, and avoid enabling iocost on production systems running vulnerable kernel versions (Feedly, Kernel Patch).