CVE-2022-50432
published 2025-10-01CVE-2022-50432: In the Linux kernel, the following vulnerability has been resolved: kernfs: fix use-after-free in __kernfs_remove Syzkaller managed to trigger concurrent calls…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.15%
4.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
kernfs: fix use-after-free in __kernfs_remove
Syzkaller managed to trigger concurrent calls to
kernfs_remove_by_name_ns() for the same file resulting in
a KASAN detected use-after-free. The race occurs when the root
node is freed during kernfs_drain().
To prevent this acquire an additional reference for the root
of the tree that is removed before calling __kernfs_remove().
Found by syzkaller with the following reproducer (slab_nomerge is
required):
syz_mount_image$ext4(0x0, &(0x7f0000000100)='./file0\x00', 0x100000, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0)
close(r0)
pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0), 0x408, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@mmap}, {@loose}, {@loose}, {@mmap}], [{@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@fsmagic={'fsmagic', 0x3d, 0x10001}}, {@dont_hash}]}})
Sample report:
BUG: KASAN: use-after-free in kernfs_type include/linux/kernfs.h:335 [inline]
BUG: KASAN: use-after-free in kernfs_leftmost_descendant fs/kernfs/dir.c:1261 [inline]
BUG: KASAN: use-after-free in __kernfs_remove.part.0+0x843/0x960 fs/kernfs/dir.c:1369
Read of size 2 at addr ffff8880088807f0 by task syz-executor.2/857
CPU: 0 PID: 857 Comm: syz-executor.2 Not tainted 6.0.0-rc3-00363-g7726d4c3e60b #5
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x6e/0x91 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:317 [inline]
print_report.cold+0x5e/0x5e5 mm/kasan/report.c:433
kasan_report+0xa3/0x130 mm/kasan/report.c:495
kernfs_type include/linux/kernfs.h:335 [inline]
kernfs_leftmost_descendant fs/kernfs/dir.c:1261 [inline]
__kernfs_remove.part.0+0x843/0x960 fs/kernfs/dir.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.7-1 (bookworm) | linux 6.0.7-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 45a140e587f3d32d8d424ed940dffb61e1739047 < 4dfd6a477a1525773469feaf3c514b2c0fef76b5 | 4dfd6a477a1525773469feaf3c514b2c0fef76b5 |
| linux | linux | >= 45a140e587f3d32d8d424ed940dffb61e1739047 < 02eb35131050735332658029082f61515b7dfe38 | 02eb35131050735332658029082f61515b7dfe38 |
| linux | linux | >= 45a140e587f3d32d8d424ed940dffb61e1739047 < 028cf780743eea79abffa7206b9dcfc080ad3546 | 028cf780743eea79abffa7206b9dcfc080ad3546 |
| linux | linux | >= 45a140e587f3d32d8d424ed940dffb61e1739047 < c78b0dc6fb7fb389d674e491fd376388cdfb1d53 | c78b0dc6fb7fb389d674e491fd376388cdfb1d53 |
| linux | linux | >= 45a140e587f3d32d8d424ed940dffb61e1739047 < 6f72a3977ba9d0e5491a5c01315204272e7f9c44 | 6f72a3977ba9d0e5491a5c01315204272e7f9c44 |
| linux | linux | >= 45a140e587f3d32d8d424ed940dffb61e1739047 < 94d2643df1e70a4c310ebb5e2c493eec33df1a06 | 94d2643df1e70a4c310ebb5e2c493eec33df1a06 |
| linux | linux | >= 45a140e587f3d32d8d424ed940dffb61e1739047 < af1b57cc39beca203559576b3046094fc9e5eb32 | af1b57cc39beca203559576b3046094fc9e5eb32 |
| linux | linux | >= 45a140e587f3d32d8d424ed940dffb61e1739047 < 4abc99652812a2ddf932f137515d5c5a04723538 | 4abc99652812a2ddf932f137515d5c5a04723538 |
| linux | linux_kernel | >= 0 < 5.10.158-1 | 5.10.158-1 |
| linux | linux_kernel | >= 0 < 6.0.7-1 | 6.0.7-1 |
| linux | linux_kernel | >= 0 < 6.0.7-1 | 6.0.7-1 |
| linux | linux_kernel | >= 0 < 6.0.7-1 | 6.0.7-1 |
| linux | linux_kernel | >= 3.14 < 4.9.332 | 4.9.332 |
| linux | linux_kernel | >= 4.10 < 4.14.298 | 4.14.298 |
| linux | linux_kernel | >= 4.15 < 4.19.264 | 4.19.264 |
| linux | linux_kernel | >= 4.20 < 5.4.223 | 5.4.223 |
| linux | linux_kernel | >= 5.11 < 5.15.77 | 5.15.77 |
| linux | linux_kernel | >= 5.16 < 6.0.7 | 6.0.7 |
| linux | linux_kernel | >= 5.5 < 5.10.153 | 5.10.153 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-pr4f-7xjv-67x4: In the Linux kernel, the following vulnerability has been resolved:
kernfs: fix use-after-free in __kernfs_remove
Syzkaller managed to trigger concu
ghsa_unreviewed·2025-10-01
CVE-2022-50432 [HIGH] CWE-416 GHSA-pr4f-7xjv-67x4: In the Linux kernel, the following vulnerability has been resolved:
kernfs: fix use-after-free in __kernfs_remove
Syzkaller managed to trigger concu
In the Linux kernel, the following vulnerability has been resolved:
kernfs: fix use-after-free in __kernfs_remove
Syzkaller managed to trigger concurrent calls to
kernfs_remove_by_name_ns() for the same file resulting in
a KASAN detected use-after-free. The race occurs when the root
node is freed during kernfs_drain().
To prevent this acquire an additional reference for the root
of the tree that is removed before calling __kernfs_remove().
Found by syzkaller with the following reproducer (slab_nomerge is
required):
syz_mount_image$ext4(0x0, &(0x7f0000000100)='./file0\x00', 0x100000, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0)
close(r0)
pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800)
mount$9p_fd(0x0, &(0
OSV
CVE-2022-50432: In the Linux kernel, the following vulnerability has been resolved: kernfs: fix use-after-free in __kernfs_remove Syzkaller managed to trigger concurr
osv·2025-10-01·CVSS 7.8
CVE-2022-50432 [HIGH] CVE-2022-50432: In the Linux kernel, the following vulnerability has been resolved: kernfs: fix use-after-free in __kernfs_remove Syzkaller managed to trigger concurr
In the Linux kernel, the following vulnerability has been resolved: kernfs: fix use-after-free in __kernfs_remove Syzkaller managed to trigger concurrent calls to kernfs_remove_by_name_ns() for the same file resulting in a KASAN detected use-after-free. The race occurs when the root node is freed during kernfs_drain(). To prevent this acquire an additional reference for the root of the tree that is removed before calling __kernfs_remove(). Found by syzkaller with the following reproducer (slab_nomerge is required): syz_mount_image$ext4(0x0, &(0x7f0000000100)='./file0\x00', 0x100000, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0) close(r0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) mount$9p_fd(0x0, &(0x7f00
Red Hat
kernel: kernfs: fix use-after-free in __kernfs_remove
vendor_redhat·2025-10-01·CVSS 7.8
CVE-2022-50432 [HIGH] CWE-362 kernel: kernfs: fix use-after-free in __kernfs_remove
kernel: kernfs: fix use-after-free in __kernfs_remove
In the Linux kernel, the following vulnerability has been resolved:
kernfs: fix use-after-free in __kernfs_remove
Syzkaller managed to trigger concurrent calls to
kernfs_remove_by_name_ns() for the same file resulting in
a KASAN detected use-after-free. The race occurs when the root
node is freed during kernfs_drain().
To prevent this acquire an additional reference for the root
of the tree that is removed before calling __kernfs_remove().
Found by syzkaller with the following reproducer (slab_nomerge is
required):
syz_mount_image$ext4(0x0, &(0x7f0000000100)='./file0\x00', 0x100000, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0)
close(r0)
pipe2(&(0x7f0000000140)={0xffffffffffffffff
Debian
CVE-2022-50432: linux - In the Linux kernel, the following vulnerability has been resolved: kernfs: fix...
vendor_debian·2022·CVSS 7.8
CVE-2022-50432 [HIGH] CVE-2022-50432: linux - In the Linux kernel, the following vulnerability has been resolved: kernfs: fix...
In the Linux kernel, the following vulnerability has been resolved: kernfs: fix use-after-free in __kernfs_remove Syzkaller managed to trigger concurrent calls to kernfs_remove_by_name_ns() for the same file resulting in a KASAN detected use-after-free. The race occurs when the root node is freed during kernfs_drain(). To prevent this acquire an additional reference for the root of the tree that is removed before calling __kernfs_remove(). Found by syzkaller with the following reproducer (slab_nomerge is required): syz_mount_image$ext4(0x0, &(0x7f0000000100)='./file0\x00', 0x100000, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0) close(r0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) mount$9p_fd(0x0, &(0x7f00
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/028cf780743eea79abffa7206b9dcfc080ad3546https://git.kernel.org/stable/c/02eb35131050735332658029082f61515b7dfe38https://git.kernel.org/stable/c/4abc99652812a2ddf932f137515d5c5a04723538https://git.kernel.org/stable/c/4dfd6a477a1525773469feaf3c514b2c0fef76b5https://git.kernel.org/stable/c/6f72a3977ba9d0e5491a5c01315204272e7f9c44https://git.kernel.org/stable/c/94d2643df1e70a4c310ebb5e2c493eec33df1a06https://git.kernel.org/stable/c/af1b57cc39beca203559576b3046094fc9e5eb32https://git.kernel.org/stable/c/c78b0dc6fb7fb389d674e491fd376388cdfb1d53
2025-10-01
Published