CVE-2022-49384

CVE-2022-49384 is a double-free vulnerability (CWE-415) in the Linux kernel's MD (multiple devices) subsystem, which handles software RAID functionality. The issue stems from the io_acct_set bioset being allocated and freed within the personality module, while erroneous free operations were also present in the md_free and md_stop functions, leading to a double free upon certain teardown sequences.

The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). A local attacker with low privileges can exploit it with low complexity and no user interaction. Successful exploitation could grant high impacts on confidentiality, integrity, and availability, potentially enabling memory corruption, arbitrary code execution, or denial of service.

Mitigation is provided through patches in the Linux kernel stable trees, as detailed in the referenced commits (e.g., 36a2fc44c574, 42b805af1024, ea7d7bd90079, f99d5b5dc8a4). These commits remove the duplicate free calls for io_acct_set in md_free and md_stop, ensuring it is solely managed by the personality module. Security practitioners should apply these kernel updates to affected systems.