{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-50171","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-06-18T10:57:27.426Z","datePublished":"2025-06-18T11:03:23.710Z","dateUpdated":"2026-08-05T08:57:38.553Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T08:57:38.553Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/sec - don't sleep when in softirq\n\nWhen kunpeng920 encryption driver is used to deencrypt and decrypt\npackets during the softirq, it is not allowed to use mutex lock. The\nkernel will report the following error:\n\nBUG: scheduling while atomic: swapper/57/0/0x00000300\nCall trace:\ndump_backtrace+0x0/0x1e4\nshow_stack+0x20/0x2c\ndump_stack+0xd8/0x140\n__schedule_bug+0x68/0x80\n__schedule+0x728/0x840\nschedule+0x50/0xe0\nschedule_preempt_disabled+0x18/0x24\n__mutex_lock.constprop.0+0x594/0x5dc\n__mutex_lock_slowpath+0x1c/0x30\nmutex_lock+0x50/0x60\nsec_request_init+0x8c/0x1a0 [hisi_sec2]\nsec_process+0x28/0x1ac [hisi_sec2]\nsec_skcipher_crypto+0xf4/0x1d4 [hisi_sec2]\nsec_skcipher_encrypt+0x1c/0x30 [hisi_sec2]\ncrypto_skcipher_encrypt+0x2c/0x40\ncrypto_authenc_encrypt+0xc8/0xfc [authenc]\ncrypto_aead_encrypt+0x2c/0x40\nechainiv_encrypt+0x144/0x1a0 [echainiv]\ncrypto_aead_encrypt+0x2c/0x40\nesp_output_tail+0x348/0x5c0 [esp4]\nesp_output+0x120/0x19c [esp4]\nxfrm_output_one+0x25c/0x4d4\nxfrm_output_resume+0x6c/0x1fc\nxfrm_output+0xac/0x3c0\nxfrm4_output+0x64/0x130\nip_build_and_send_pkt+0x158/0x20c\ntcp_v4_send_synack+0xdc/0x1f0\ntcp_conn_request+0x7d0/0x994\ntcp_v4_conn_request+0x58/0x6c\ntcp_v6_conn_request+0xf0/0x100\ntcp_rcv_state_process+0x1cc/0xd60\ntcp_v4_do_rcv+0x10c/0x250\ntcp_v4_rcv+0xfc4/0x10a4\nip_protocol_deliver_rcu+0xf4/0x200\nip_local_deliver_finish+0x58/0x70\nip_local_deliver+0x68/0x120\nip_sublist_rcv_finish+0x70/0x94\nip_list_rcv_finish.constprop.0+0x17c/0x1d0\nip_sublist_rcv+0x40/0xb0\nip_list_rcv+0x140/0x1dc\n__netif_receive_skb_list_core+0x154/0x28c\n__netif_receive_skb_list+0x120/0x1a0\nnetif_receive_skb_list_internal+0xe4/0x1f0\nnapi_complete_done+0x70/0x1f0\ngro_cell_poll+0x9c/0xb0\nnapi_poll+0xcc/0x264\nnet_rx_action+0xd4/0x21c\n__do_softirq+0x130/0x358\nirq_exit+0x11c/0x13c\n__handle_domain_irq+0x88/0xf0\ngic_handle_irq+0x78/0x2c0\nel1_irq+0xb8/0x140\narch_cpu_idle+0x18/0x40\ndefault_idle_call+0x5c/0x1c0\ncpuidle_idle_call+0x174/0x1b0\ndo_idle+0xc8/0x160\ncpu_startup_entry+0x30/0x11c\nsecondary_start_kernel+0x158/0x1e4\nsoftirq: huh, entered softirq 3 NET_RX 0000000093774ee4 with\npreempt_count 00000100, exited with fffffe00?"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The commit's call chain shows a remote TCP SYN (netif_receive → tcp_v4_rcv → tcp_conn_request) causing esp_output → HiSilicon SEC encrypt in softirq; inbound ESP decrypt uses the same mutex-protected sec_process path. On Kunpeng IPsec gateways this is reachable over the network.\nAC:L - An attacker who can send traffic that drives SEC crypto fully controls load and can create req_lock contention across concurrent softirq requests and completions so mutex_lock takes the slowpath; no attacker-uncontrollable race or memory layout is required.\nPR:N - The documented trigger is an unauthenticated TCP SYN whose SYN-ACK is ESP-encrypted under an existing SPD/SA (deployment config, e.g. site-to-site VPN); the attacker need not authenticate to the host or complete IKE on the trigger path.\nUI:N - Packet receive and softirq ESP/crypto run entirely in the network stack; no victim mount, open, or other interactive action is required.\nS:U - Impact is confined to the host kernel's own softirq/preempt state and availability; this is in-kernel DoS, not VM escape, IOMMU bypass, or another cross-boundary impact.\nC:N - The defect is sleeping in atomic context (mutex in softirq) with preempt_count corruption; there is no OOB read, UAF, or other disclosure primitive.\nI:N - There is no memory corruption, write primitive, or control-flow hijack—only an illegal schedule in softirq—so integrity and code execution are not implicated.\nA:H - The bug produces BUG: scheduling while atomic and softirq preempt_count underflow (exited with fffffe00), which can hang or crash the kernel and is High availability impact."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/crypto/hisilicon/sec2/sec.h","drivers/crypto/hisilicon/sec2/sec_crypto.c"],"versions":[{"version":"416d82204df44ef727de6eafafeaa4d12fdc78dc","lessThan":"16e18a8ac7c9748cf35a8d2f0ba2c6e8850e7568","status":"affected","versionType":"git"},{"version":"416d82204df44ef727de6eafafeaa4d12fdc78dc","lessThan":"aa495dfe71229b9034b59d8072ff0b2325ddd5ee","status":"affected","versionType":"git"},{"version":"416d82204df44ef727de6eafafeaa4d12fdc78dc","lessThan":"4a461ba5b9753352f438824fdd915cba675b1733","status":"affected","versionType":"git"},{"version":"416d82204df44ef727de6eafafeaa4d12fdc78dc","lessThan":"c9be45e4c69fde36522274f04d1aa0d097ae3958","status":"affected","versionType":"git"},{"version":"416d82204df44ef727de6eafafeaa4d12fdc78dc","lessThan":"02884a4f12de11f54d4ca67a07dd1f111d96fdbd","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/crypto/hisilicon/sec2/sec.h","drivers/crypto/hisilicon/sec2/sec_crypto.c"],"versions":[{"version":"5.5","status":"affected"},{"version":"0","lessThan":"5.5","status":"unaffected","versionType":"semver"},{"version":"5.10.137","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.61","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"5.18.18","lessThanOrEqual":"5.18.*","status":"unaffected","versionType":"semver"},{"version":"5.19.2","lessThanOrEqual":"5.19.*","status":"unaffected","versionType":"semver"},{"version":"6.0","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.10.137"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.15.61"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.18.18"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.19.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"6.0"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/16e18a8ac7c9748cf35a8d2f0ba2c6e8850e7568"},{"url":"https://git.kernel.org/stable/c/aa495dfe71229b9034b59d8072ff0b2325ddd5ee"},{"url":"https://git.kernel.org/stable/c/4a461ba5b9753352f438824fdd915cba675b1733"},{"url":"https://git.kernel.org/stable/c/c9be45e4c69fde36522274f04d1aa0d097ae3958"},{"url":"https://git.kernel.org/stable/c/02884a4f12de11f54d4ca67a07dd1f111d96fdbd"}],"title":"crypto: hisilicon/sec - don't sleep when in softirq","x_generator":{"engine":"bippy-1.2.0"}}}}