{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-50022","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-06-18T10:57:27.394Z","datePublished":"2025-06-18T11:01:25.965Z","dateUpdated":"2026-08-05T08:57:10.904Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T08:57:10.904Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers:md:fix a potential use-after-free bug\n\nIn line 2884, \"raid5_release_stripe(sh);\" drops the reference to sh and\nmay cause sh to be released. However, sh is subsequently used in lines\n2886 \"if (sh->batch_head && sh != sh->batch_head)\". This may result in an\nuse-after-free bug.\n\nIt can be fixed by moving \"raid5_release_stripe(sh);\" to the bottom of\nthe function."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is the md/raid5 local write-completion callback (raid5_end_write_request), reached via writes to a RAID5/6 array or a filesystem on it through md_submit_bio → raid5_make_request → ops_run_io; it does not parse network protocol input.\nAC:L - An unprivileged attacker can drive full-stripe sequential writes that enable stripe batching and concurrent I/O to pressure stripe reclaim; per kernel CNA guidance, use-after-free bugs are AC:L unless a race is wholly outside attacker influence.\nPR:L - md_submit_bio/raid5 I/O paths perform no capability checks; any unprivileged local user who can write a file on a RAID5/6-backed filesystem (typical NAS/server deployment) triggers the completion path without init-namespace root.\nUI:N - The attacker’s own write syscalls generate the batched stripe I/O whose completion hits the buggy release-then-use sequence; no separate victim action is required.\nS:U - The use-after-free corrupts kernel stripe_head heap state within the same host kernel authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - Use-after-free of stripe_head lets an attacker reclaim and spray the freed object, then observe or control subsequent reads of sh->batch_head and related fields, yielding a kernel information-disclosure primitive.\nI:H - Reclaiming the freed stripe_head and then calling raid5_release_stripe on a attacker-influenced batch_head pointer provides a write/refcount primitive against kernel heap objects, enabling corruption and control-flow hijacking.\nA:H - Use-after-free on a live stripe_head in the RAID5 write-completion path causes kernel oops/panic or storage-stack corruption, taking down the array and potentially the machine."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/md/raid5.c"],"versions":[{"version":"59fc630b8b5f9f21c8ce3ba153341c107dce1b0c","lessThan":"7470a4314b239e9a9580f248fdf4c9a92805490e","status":"affected","versionType":"git"},{"version":"59fc630b8b5f9f21c8ce3ba153341c107dce1b0c","lessThan":"09cf99bace7789d91caa8d10fbcfc8b2fb35857f","status":"affected","versionType":"git"},{"version":"59fc630b8b5f9f21c8ce3ba153341c107dce1b0c","lessThan":"e5b3dd2d92c4511e81f6e4ec9c5bb7ad25e03d13","status":"affected","versionType":"git"},{"version":"59fc630b8b5f9f21c8ce3ba153341c107dce1b0c","lessThan":"f5d46f1b47f65da1faf468277b261eb78c8e25b5","status":"affected","versionType":"git"},{"version":"59fc630b8b5f9f21c8ce3ba153341c107dce1b0c","lessThan":"5d8325fd15892c8ab1146edc1d7ed8463de39636","status":"affected","versionType":"git"},{"version":"59fc630b8b5f9f21c8ce3ba153341c107dce1b0c","lessThan":"d9b94c3ace549433de8a93eeb27b0391fc8ac406","status":"affected","versionType":"git"},{"version":"59fc630b8b5f9f21c8ce3ba153341c107dce1b0c","lessThan":"eb3a4f73f43f839df981dda5859e8e075067a360","status":"affected","versionType":"git"},{"version":"59fc630b8b5f9f21c8ce3ba153341c107dce1b0c","lessThan":"104212471b1c1817b311771d817fb692af983173","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/md/raid5.c"],"versions":[{"version":"4.1","status":"affected"},{"version":"0","lessThan":"4.1","status":"unaffected","versionType":"semver"},{"version":"4.9.326","lessThanOrEqual":"4.9.*","status":"unaffected","versionType":"semver"},{"version":"4.14.291","lessThanOrEqual":"4.14.*","status":"unaffected","versionType":"semver"},{"version":"4.19.256","lessThanOrEqual":"4.19.*","status":"unaffected","versionType":"semver"},{"version":"5.4.211","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.138","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.63","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"5.19.4","lessThanOrEqual":"5.19.*","status":"unaffected","versionType":"semver"},{"version":"6.0","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1","versionEndExcluding":"4.9.326"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1","versionEndExcluding":"4.14.291"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1","versionEndExcluding":"4.19.256"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1","versionEndExcluding":"5.4.211"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1","versionEndExcluding":"5.10.138"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1","versionEndExcluding":"5.15.63"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1","versionEndExcluding":"5.19.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1","versionEndExcluding":"6.0"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/7470a4314b239e9a9580f248fdf4c9a92805490e"},{"url":"https://git.kernel.org/stable/c/09cf99bace7789d91caa8d10fbcfc8b2fb35857f"},{"url":"https://git.kernel.org/stable/c/e5b3dd2d92c4511e81f6e4ec9c5bb7ad25e03d13"},{"url":"https://git.kernel.org/stable/c/f5d46f1b47f65da1faf468277b261eb78c8e25b5"},{"url":"https://git.kernel.org/stable/c/5d8325fd15892c8ab1146edc1d7ed8463de39636"},{"url":"https://git.kernel.org/stable/c/d9b94c3ace549433de8a93eeb27b0391fc8ac406"},{"url":"https://git.kernel.org/stable/c/eb3a4f73f43f839df981dda5859e8e075067a360"},{"url":"https://git.kernel.org/stable/c/104212471b1c1817b311771d817fb692af983173"}],"title":"drivers:md:fix a potential use-after-free bug","x_generator":{"engine":"bippy-1.2.0"}}}}