CVE-2022-50280
published 2025-09-15CVE-2022-50280: In the Linux kernel, the following vulnerability has been resolved: pnode: terminate at peers of source The propagate_mnt() function handles mount propagation…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.15%
4.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
pnode: terminate at peers of source
The propagate_mnt() function handles mount propagation when creating
mounts and propagates the source mount tree @source_mnt to all
applicable nodes of the destination propagation mount tree headed by
@dest_mnt.
Unfortunately it contains a bug where it fails to terminate at peers of
@source_mnt when looking up copies of the source mount that become
masters for copies of the source mount tree mounted on top of slaves in
the destination propagation tree causing a NULL dereference.
Once the mechanics of the bug are understood it's easy to trigger.
Because of unprivileged user namespaces it is available to unprivileged
users.
While fixing this bug we've gotten confused multiple times due to
unclear terminology or missing concepts. So let's start this with some
clarifications:
* The terms "master" or "peer" denote a shared mount. A shared mount
belongs to a peer group.
* A peer group is a set of shared mounts that propagate to each other.
They are identified by a peer group id. The peer group id is available
in @shared_mnt->mnt_group_id.
Shared mounts within the same peer group have the same peer group id.
The peers in a peer group can be reached via @shared_mnt->mnt_share.
* The terms "slave mount" or "dependent mount" denote a mount that
receives propagation from a peer in a peer group. IOW, shared mounts
may have slave mounts and slave mounts have shared mounts as their
master. Slave mounts of a given peer in a peer group are listed on
that peers slave list available at @shared_mnt->mnt_slave_list.
* The term "master mount" denotes a mount in a peer group. IOW, it
denotes a shared mount or a peer mount in a peer group. The term
"master mount" - or "master" for short - is mostly used when talking
in the context of slave mounts that receive propagation from a master
mount. A master mount of a slave identifies the closest peer group a
slave mount receives prop
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.4-1 (bookworm) | linux 6.1.4-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 3.14.3 < 3.15 | 3.15 |
| linux | linux | >= f2ebb3a921c1ca1e2ddd9242e95a1989a50c4c68 < cad0d17fb2b0540180ab59e2cd48ad348cc1ee4c | cad0d17fb2b0540180ab59e2cd48ad348cc1ee4c |
| linux | linux | >= f2ebb3a921c1ca1e2ddd9242e95a1989a50c4c68 < cc997490be65da0af8c75a6244fc80bb66c53ce0 | cc997490be65da0af8c75a6244fc80bb66c53ce0 |
| linux | linux | >= f2ebb3a921c1ca1e2ddd9242e95a1989a50c4c68 < 7f57df69de7f05302fad584eb8e3f34de39e0311 | 7f57df69de7f05302fad584eb8e3f34de39e0311 |
| linux | linux | >= f2ebb3a921c1ca1e2ddd9242e95a1989a50c4c68 < 2dae4211b579ce98985876a73a78466e285238ff | 2dae4211b579ce98985876a73a78466e285238ff |
| linux | linux | >= f2ebb3a921c1ca1e2ddd9242e95a1989a50c4c68 < b591b2919d018ef91b4a9571edca94105bcad3df | b591b2919d018ef91b4a9571edca94105bcad3df |
| linux | linux | >= f2ebb3a921c1ca1e2ddd9242e95a1989a50c4c68 < c24cc476acd8bccb5af54849aac5e779d8223bf5 | c24cc476acd8bccb5af54849aac5e779d8223bf5 |
| linux | linux | >= f2ebb3a921c1ca1e2ddd9242e95a1989a50c4c68 < e7c9f10c44a8919cd8bbd51b228c84d0caf7d518 | e7c9f10c44a8919cd8bbd51b228c84d0caf7d518 |
| linux | linux | >= f2ebb3a921c1ca1e2ddd9242e95a1989a50c4c68 < 784a4f995ee24460aa72e00b085612fad57ebce5 | 784a4f995ee24460aa72e00b085612fad57ebce5 |
| linux | linux | >= f2ebb3a921c1ca1e2ddd9242e95a1989a50c4c68 < 11933cf1d91d57da9e5c53822a540bbdc2656c16 | 11933cf1d91d57da9e5c53822a540bbdc2656c16 |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 3.14.3 < 4.9.337 | 4.9.337 |
| linux | linux_kernel | >= 4.10 < 4.14.303 | 4.14.303 |
| linux | linux_kernel | >= 4.15 < 4.19.270 | 4.19.270 |
| linux | linux_kernel | >= 4.20 < 5.4.229 | 5.4.229 |
| linux | linux_kernel | >= 5.11 < 5.15.87 | 5.15.87 |
| linux | linux_kernel | >= 5.16 < 6.0.17 | 6.0.17 |
| linux | linux_kernel | >= 5.5 < 5.10.163 | 5.10.163 |
| linux | linux_kernel | >= 6.1 < 6.1.3 | 6.1.3 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: pnode: terminate at peers of source
vendor_redhat·2025-09-15·CVSS 5.5
CVE-2022-50280 [MEDIUM] CWE-476 kernel: pnode: terminate at peers of source
kernel: pnode: terminate at peers of source
In the Linux kernel, the following vulnerability has been resolved:
pnode: terminate at peers of source
The propagate_mnt() function handles mount propagation when creating
mounts and propagates the source mount tree @source_mnt to all
applicable nodes of the destination propagation mount tree headed by
@dest_mnt.
Unfortunately it contains a bug where it fails to terminate at peers of
@source_mnt when looking up copies of the source mount that become
masters for copies of the source mount tree mounted on top of slaves in
the destination propagation tree causing a NULL dereference.
Once the mechanics of the bug are understood it's easy to trigger.
Because of unprivileged user namespaces it is available to unprivileged
users.
While fixing this bug
Debian
CVE-2022-50280: linux - In the Linux kernel, the following vulnerability has been resolved: pnode: term...
vendor_debian·2022·CVSS 5.5
CVE-2022-50280 [MEDIUM] CVE-2022-50280: linux - In the Linux kernel, the following vulnerability has been resolved: pnode: term...
In the Linux kernel, the following vulnerability has been resolved: pnode: terminate at peers of source The propagate_mnt() function handles mount propagation when creating mounts and propagates the source mount tree @source_mnt to all applicable nodes of the destination propagation mount tree headed by @dest_mnt. Unfortunately it contains a bug where it fails to terminate at peers of @source_mnt when looking up copies of the source mount that become masters for copies of the source mount tree mounted on top of slaves in the destination propagation tree causing a NULL dereference. Once the mechanics of the bug are understood it's easy to trigger. Because of unprivileged user namespaces it is available to unprivileged users. While fixing this bug we've gotten confused multiple times due to
OSV
CVE-2022-50280: In the Linux kernel, the following vulnerability has been resolved: pnode: terminate at peers of source The propagate_mnt() function handles mount pro
osv·2025-09-15·CVSS 5.5
CVE-2022-50280 [MEDIUM] CVE-2022-50280: In the Linux kernel, the following vulnerability has been resolved: pnode: terminate at peers of source The propagate_mnt() function handles mount pro
In the Linux kernel, the following vulnerability has been resolved: pnode: terminate at peers of source The propagate_mnt() function handles mount propagation when creating mounts and propagates the source mount tree @source_mnt to all applicable nodes of the destination propagation mount tree headed by @dest_mnt. Unfortunately it contains a bug where it fails to terminate at peers of @source_mnt when looking up copies of the source mount that become masters for copies of the source mount tree mounted on top of slaves in the destination propagation tree causing a NULL dereference. Once the mechanics of the bug are understood it's easy to trigger. Because of unprivileged user namespaces it is available to unprivileged users. While fixing this bug we've gotten confused multiple times due to
GHSA
GHSA-3pxv-j5r5-v5qh: In the Linux kernel, the following vulnerability has been resolved:
pnode: terminate at peers of source
The propagate_mnt() function handles mount p
ghsa_unreviewed·2025-09-15
CVE-2022-50280 [MEDIUM] CWE-476 GHSA-3pxv-j5r5-v5qh: In the Linux kernel, the following vulnerability has been resolved:
pnode: terminate at peers of source
The propagate_mnt() function handles mount p
In the Linux kernel, the following vulnerability has been resolved:
pnode: terminate at peers of source
The propagate_mnt() function handles mount propagation when creating
mounts and propagates the source mount tree @source_mnt to all
applicable nodes of the destination propagation mount tree headed by
@dest_mnt.
Unfortunately it contains a bug where it fails to terminate at peers of
@source_mnt when looking up copies of the source mount that become
masters for copies of the source mount tree mounted on top of slaves in
the destination propagation tree causing a NULL dereference.
Once the mechanics of the bug are understood it's easy to trigger.
Because of unprivileged user namespaces it is available to unprivileged
users.
While fixing this bug we've gotten confused multiple times du
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/11933cf1d91d57da9e5c53822a540bbdc2656c16https://git.kernel.org/stable/c/2dae4211b579ce98985876a73a78466e285238ffhttps://git.kernel.org/stable/c/784a4f995ee24460aa72e00b085612fad57ebce5https://git.kernel.org/stable/c/7f57df69de7f05302fad584eb8e3f34de39e0311https://git.kernel.org/stable/c/b591b2919d018ef91b4a9571edca94105bcad3dfhttps://git.kernel.org/stable/c/c24cc476acd8bccb5af54849aac5e779d8223bf5https://git.kernel.org/stable/c/cad0d17fb2b0540180ab59e2cd48ad348cc1ee4chttps://git.kernel.org/stable/c/cc997490be65da0af8c75a6244fc80bb66c53ce0https://git.kernel.org/stable/c/e7c9f10c44a8919cd8bbd51b228c84d0caf7d518
2025-09-15
Published