CVE-2022-50022
published 2025-06-18CVE-2022-50022: In the Linux kernel, the following vulnerability has been resolved: drivers:md:fix a potential use-after-free bug In line 2884, "raid5_release_stripe(sh);"…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.21%
12.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
drivers:md:fix a potential use-after-free bug
In line 2884, "raid5_release_stripe(sh);" drops the reference to sh and
may cause sh to be released. However, sh is subsequently used in lines
2886 "if (sh->batch_head && sh != sh->batch_head)". This may result in an
use-after-free bug.
It can be fixed by moving "raid5_release_stripe(sh);" to the bottom of
the function.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.2-1 (bookworm) | linux 6.0.2-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 59fc630b8b5f9f21c8ce3ba153341c107dce1b0c < 7470a4314b239e9a9580f248fdf4c9a92805490e | 7470a4314b239e9a9580f248fdf4c9a92805490e |
| linux | linux | >= 59fc630b8b5f9f21c8ce3ba153341c107dce1b0c < 09cf99bace7789d91caa8d10fbcfc8b2fb35857f | 09cf99bace7789d91caa8d10fbcfc8b2fb35857f |
| linux | linux | >= 59fc630b8b5f9f21c8ce3ba153341c107dce1b0c < e5b3dd2d92c4511e81f6e4ec9c5bb7ad25e03d13 | e5b3dd2d92c4511e81f6e4ec9c5bb7ad25e03d13 |
| linux | linux | >= 59fc630b8b5f9f21c8ce3ba153341c107dce1b0c < f5d46f1b47f65da1faf468277b261eb78c8e25b5 | f5d46f1b47f65da1faf468277b261eb78c8e25b5 |
| linux | linux | >= 59fc630b8b5f9f21c8ce3ba153341c107dce1b0c < 5d8325fd15892c8ab1146edc1d7ed8463de39636 | 5d8325fd15892c8ab1146edc1d7ed8463de39636 |
| linux | linux | >= 59fc630b8b5f9f21c8ce3ba153341c107dce1b0c < d9b94c3ace549433de8a93eeb27b0391fc8ac406 | d9b94c3ace549433de8a93eeb27b0391fc8ac406 |
| linux | linux | >= 59fc630b8b5f9f21c8ce3ba153341c107dce1b0c < eb3a4f73f43f839df981dda5859e8e075067a360 | eb3a4f73f43f839df981dda5859e8e075067a360 |
| linux | linux | >= 59fc630b8b5f9f21c8ce3ba153341c107dce1b0c < 104212471b1c1817b311771d817fb692af983173 | 104212471b1c1817b311771d817fb692af983173 |
| linux | linux_kernel | >= 0 < 5.10.140-1 | 5.10.140-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 4.1 < 4.9.326 | 4.9.326 |
| linux | linux_kernel | >= 4.10 < 4.14.291 | 4.14.291 |
| linux | linux_kernel | >= 4.15 < 4.19.256 | 4.19.256 |
| linux | linux_kernel | >= 4.20 < 5.4.211 | 5.4.211 |
| linux | linux_kernel | >= 5.11 < 5.15.63 | 5.15.63 |
| linux | linux_kernel | >= 5.16 < 5.19.4 | 5.19.4 |
| linux | linux_kernel | >= 5.5 < 5.10.138 | 5.10.138 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: drivers:md:fix a potential use-after-free bug
vendor_redhat·2025-06-18·CVSS 7.8
CVE-2022-50022 [HIGH] CWE-416 kernel: drivers:md:fix a potential use-after-free bug
kernel: drivers:md:fix a potential use-after-free bug
In the Linux kernel, the following vulnerability has been resolved:
drivers:md:fix a potential use-after-free bug
In line 2884, "raid5_release_stripe(sh);" drops the reference to sh and
may cause sh to be released. However, sh is subsequently used in lines
2886 "if (sh->batch_head && sh != sh->batch_head)". This may result in an
use-after-free bug.
It can be fixed by moving "raid5_release_stripe(sh);" to the bottom of
the function.
A use-after-free bug exists in the linux kernel such that in the line "raid5_release_stripe(sh);" drops the reference to sh and
may cause sh to be released. However, sh is subsequently used in lines "if (sh->batch_head && sh != sh->batch_head)" resulting in a minor application crash.
Mitigation: Mitigation
Debian
CVE-2022-50022: linux - In the Linux kernel, the following vulnerability has been resolved: drivers:md:...
vendor_debian·2022·CVSS 7.8
CVE-2022-50022 [HIGH] CVE-2022-50022: linux - In the Linux kernel, the following vulnerability has been resolved: drivers:md:...
In the Linux kernel, the following vulnerability has been resolved: drivers:md:fix a potential use-after-free bug In line 2884, "raid5_release_stripe(sh);" drops the reference to sh and may cause sh to be released. However, sh is subsequently used in lines 2886 "if (sh->batch_head && sh != sh->batch_head)". This may result in an use-after-free bug. It can be fixed by moving "raid5_release_stripe(sh);" to the bottom of the function.
Scope: local
bookworm: resolved (fixed in 6.0.2-1)
bullseye: resolved (fixed in 5.10.140-1)
forky: resolved (fixed in 6.0.2-1)
sid: resolved (fixed in 6.0.2-1)
trixie: resolved (fixed in 6.0.2-1)
GHSA
GHSA-88r3-qhfp-8mj6: In the Linux kernel, the following vulnerability has been resolved:
drivers:md:fix a potential use-after-free bug
In line 2884, "raid5_release_strip
ghsa_unreviewed·2025-06-18
CVE-2022-50022 [HIGH] CWE-416 GHSA-88r3-qhfp-8mj6: In the Linux kernel, the following vulnerability has been resolved:
drivers:md:fix a potential use-after-free bug
In line 2884, "raid5_release_strip
In the Linux kernel, the following vulnerability has been resolved:
drivers:md:fix a potential use-after-free bug
In line 2884, "raid5_release_stripe(sh);" drops the reference to sh and
may cause sh to be released. However, sh is subsequently used in lines
2886 "if (sh->batch_head && sh != sh->batch_head)". This may result in an
use-after-free bug.
It can be fixed by moving "raid5_release_stripe(sh);" to the bottom of
the function.
OSV
CVE-2022-50022: In the Linux kernel, the following vulnerability has been resolved: drivers:md:fix a potential use-after-free bug In line 2884, "raid5_release_stripe(
osv·2025-06-18·CVSS 7.8
CVE-2022-50022 [HIGH] CVE-2022-50022: In the Linux kernel, the following vulnerability has been resolved: drivers:md:fix a potential use-after-free bug In line 2884, "raid5_release_stripe(
In the Linux kernel, the following vulnerability has been resolved: drivers:md:fix a potential use-after-free bug In line 2884, "raid5_release_stripe(sh);" drops the reference to sh and may cause sh to be released. However, sh is subsequently used in lines 2886 "if (sh->batch_head && sh != sh->batch_head)". This may result in an use-after-free bug. It can be fixed by moving "raid5_release_stripe(sh);" to the bottom of the function.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/09cf99bace7789d91caa8d10fbcfc8b2fb35857fhttps://git.kernel.org/stable/c/104212471b1c1817b311771d817fb692af983173https://git.kernel.org/stable/c/5d8325fd15892c8ab1146edc1d7ed8463de39636https://git.kernel.org/stable/c/7470a4314b239e9a9580f248fdf4c9a92805490ehttps://git.kernel.org/stable/c/d9b94c3ace549433de8a93eeb27b0391fc8ac406https://git.kernel.org/stable/c/e5b3dd2d92c4511e81f6e4ec9c5bb7ad25e03d13https://git.kernel.org/stable/c/eb3a4f73f43f839df981dda5859e8e075067a360https://git.kernel.org/stable/c/f5d46f1b47f65da1faf468277b261eb78c8e25b5
2025-06-18
Published