CVE-2022-50163

published 2025-06-18

CVE-2022-50163: In the Linux kernel, the following vulnerability has been resolved: ax25: fix incorrect dev_tracker usage While investigating a separate rose issue [1], and…

Priority P3 39 high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

In the Linux kernel, the following vulnerability has been resolved:

ax25: fix incorrect dev_tracker usage

While investigating a separate rose issue [1], and enabling
CONFIG_NET_DEV_REFCNT_TRACKER=y, Bernard reported an orthogonal ax25 issue [2]

An ax25_dev can be used by one (or many) struct ax25_cb.
We thus need different dev_tracker, one per struct ax25_cb.

After this patch is applied, we are able to focus on rose.

[1] https://lore.kernel.org/netdev/[email protected]/

[2]
[ 205.798723] reference already released.
[ 205.798732] allocated in:
[ 205.798734] ax25_bind+0x1a2/0x230 [ax25]
[ 205.798747] __sys_bind+0xea/0x110
[ 205.798753] __x64_sys_bind+0x18/0x20
[ 205.798758] do_syscall_64+0x5c/0x80
[ 205.798763] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 205.798768] freed in:
[ 205.798770] ax25_release+0x115/0x370 [ax25]
[ 205.798778] __sock_release+0x42/0xb0
[ 205.798782] sock_close+0x15/0x20
[ 205.798785] __fput+0x9f/0x260
[ 205.798789] ____fput+0xe/0x10
[ 205.798792] task_work_run+0x64/0xa0
[ 205.798798] exit_to_user_mode_prepare+0x18b/0x190
[ 205.798804] syscall_exit_to_user_mode+0x26/0x40
[ 205.798808] do_syscall_64+0x69/0x80
[ 205.798812] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 205.798827] ------------[ cut here ]------------
[ 205.798829] WARNING: CPU: 2 PID: 2605 at lib/ref_tracker.c:136 ref_tracker_free.cold+0x60/0x81
[ 205.798837] Modules linked in: rose netrom mkiss ax25 rfcomm cmac algif_hash algif_skcipher af_alg bnep snd_hda_codec_hdmi nls_iso8859_1 i915 rtw88_8821ce rtw88_8821c x86_pkg_temp_thermal rtw88_pci intel_powerclamp rtw88_core snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio coretemp snd_hda_intel kvm_intel snd_intel_dspcfg mac80211 snd_hda_codec kvm i2c_algo_bit drm_buddy drm_dp_helper btusb drm_kms_helper snd_hwdep btrtl snd_hda_core btbcm joydev crct10dif_pclmul btintel crc32_pclmul ghash_clmulni_intel mei_hdcp btmtk intel_rapl_msr aesni_intel bluetooth input_leds snd_pcm crypto_simd syscopyarea pr

Affected

27 ranges · showing 25

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.19.6-1 (bookworm)	linux 5.19.6-1 (bookworm)
linux	linux	—	—
linux	linux	—	—
linux	linux	—	—
linux	linux	—	—
linux	linux	—	—
linux	linux	—	—
linux	linux	>= 4.14.277 < 4.15	4.15
linux	linux	>= 4.19.240 < 4.20	4.20
linux	linux	>= 5.10.112 < 5.11	5.11
linux	linux	>= 5.15.35 < 5.16	5.16
linux	linux	>= 5.4.190 < 5.5	5.5
linux	linux	>= feef318c855a361a1eccd880f33e88c460eb63b4 < d08e3d71e5942f77fbff7f3529ed7fc82fbb3dfa	d08e3d71e5942f77fbff7f3529ed7fc82fbb3dfa
linux	linux	>= feef318c855a361a1eccd880f33e88c460eb63b4 < 4294df1374450912b2f64ee3cf575069fc784679	4294df1374450912b2f64ee3cf575069fc784679
linux	linux	>= feef318c855a361a1eccd880f33e88c460eb63b4 < d7c4c9e075f8cc6d88d277bc24e5d99297f03c06	d7c4c9e075f8cc6d88d277bc24e5d99297f03c06
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 5.19.6-1	5.19.6-1
linux	linux_kernel	>= 0 < 5.19.6-1	5.19.6-1
linux	linux_kernel	>= 0 < 5.19.6-1	5.19.6-1
linux	linux_kernel	>= 4.14.277 < 4.15	4.15
linux	linux_kernel	>= 4.19.240 < 4.20	4.20
linux	linux_kernel	>= 5.10.112 < 5.11	5.11
linux	linux_kernel	>= 5.15.35 < 5.16	5.16
linux	linux_kernel	>= 5.17.1 < 5.18.18	5.18.18
linux	linux_kernel	>= 5.19 < 5.19.2	5.19.2

CVSS provenance

nvd v3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

osv 7.8 HIGH

vendor_debian 7.8 HIGH

vendor_redhat 7.8 HIGH

vendor_msrc 7.0 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.