CVE-2022-50726
published 2025-12-24CVE-2022-50726: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix possible use-after-free in async command interface mlx5_cmd_cleanup_async_ctx…
PriorityP341high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.19%
8.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Fix possible use-after-free in async command interface
mlx5_cmd_cleanup_async_ctx should return only after all its callback
handlers were completed. Before this patch, the below race between
mlx5_cmd_cleanup_async_ctx and mlx5_cmd_exec_cb_handler was possible and
lead to a use-after-free:
1. mlx5_cmd_cleanup_async_ctx is called while num_inflight is 2 (i.e.
elevated by 1, a single inflight callback).
2. mlx5_cmd_cleanup_async_ctx decreases num_inflight to 1.
3. mlx5_cmd_exec_cb_handler is called, decreases num_inflight to 0 and
is about to call wake_up().
4. mlx5_cmd_cleanup_async_ctx calls wait_event, which returns
immediately as the condition (num_inflight == 0) holds.
5. mlx5_cmd_cleanup_async_ctx returns.
6. The caller of mlx5_cmd_cleanup_async_ctx frees the mlx5_async_ctx
object.
7. mlx5_cmd_exec_cb_handler goes on and calls wake_up() on the freed
object.
Fix it by syncing using a completion object. Mark it completed when
num_inflight reaches 0.
Trace:
BUG: KASAN: use-after-free in do_raw_spin_lock+0x23d/0x270
Read of size 4 at addr ffff888139cd12f4 by task swapper/5/0
CPU: 5 PID: 0 Comm: swapper/5 Not tainted 6.0.0-rc3_for_upstream_debug_2022_08_30_13_10 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
Call Trace:
dump_stack_lvl+0x57/0x7d
print_report.cold+0x2d5/0x684
? do_raw_spin_lock+0x23d/0x270
kasan_report+0xb1/0x1a0
? do_raw_spin_lock+0x23d/0x270
do_raw_spin_lock+0x23d/0x270
? rwlock_bug.part.0+0x90/0x90
? __delete_object+0xb8/0x100
? lock_downgrade+0x6e0/0x6e0
_raw_spin_lock_irqsave+0x43/0x60
? __wake_up_common_lock+0xb9/0x140
__wake_up_common_lock+0xb9/0x140
? __wake_up_common+0x650/0x650
? destroy_tis_callback+0x53/0x70 [mlx5_core]
? kasan_set_track+0x21/0x30
? destroy_tis_callback+0x53/0x70 [mlx5_core]
? kfree+0x1ba/0x520
? do_raw_spin_unlock+0x54/0x220
mlx5_cmd_exec_cb_handler+0x136/0x1a0 [mlx5_core
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.7-1 (bookworm) | linux 6.0.7-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= e355477ed9e4f401e3931043df97325d38552d54 < 69dd3ad406c49aa69ce4852c15231ac56af8caf9 | 69dd3ad406c49aa69ce4852c15231ac56af8caf9 |
| linux | linux | >= e355477ed9e4f401e3931043df97325d38552d54 < bbcc06933f35651294ea1e963757502312c2171f | bbcc06933f35651294ea1e963757502312c2171f |
| linux | linux | >= e355477ed9e4f401e3931043df97325d38552d54 < ab3de780c176bb91995c6166a576b370d9726e17 | ab3de780c176bb91995c6166a576b370d9726e17 |
| linux | linux | >= e355477ed9e4f401e3931043df97325d38552d54 < 0aa3ee1e4e5c9ed5dda11249450d609c3072c54e | 0aa3ee1e4e5c9ed5dda11249450d609c3072c54e |
| linux | linux | >= e355477ed9e4f401e3931043df97325d38552d54 < bacd22df95147ed673bec4692ab2d4d585935241 | bacd22df95147ed673bec4692ab2d4d585935241 |
| linux | linux_kernel | >= 0 < 5.10.158-1 | 5.10.158-1 |
| linux | linux_kernel | >= 0 < 6.0.7-1 | 6.0.7-1 |
| linux | linux_kernel | >= 0 < 6.0.7-1 | 6.0.7-1 |
| linux | linux_kernel | >= 0 < 6.0.7-1 | 6.0.7-1 |
| linux | linux_kernel | >= 5.1.0 < 5.4.223 | 5.4.223 |
| linux | linux_kernel | >= 5.11.0 < 5.15.77 | 5.15.77 |
| linux | linux_kernel | >= 5.16.0 < 6.0.7 | 6.0.7 |
| linux | linux_kernel | >= 5.5.0 < 5.10.153 | 5.10.153 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat6.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: net/mlx5: Fix possible use-after-free in async command interface
vendor_redhat·2025-12-24·CVSS 6.2
CVE-2022-50726 [MEDIUM] CWE-416 kernel: net/mlx5: Fix possible use-after-free in async command interface
kernel: net/mlx5: Fix possible use-after-free in async command interface
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Fix possible use-after-free in async command interface
mlx5_cmd_cleanup_async_ctx should return only after all its callback
handlers were completed. Before this patch, the below race between
mlx5_cmd_cleanup_async_ctx and mlx5_cmd_exec_cb_handler was possible and
lead to a use-after-free:
1. mlx5_cmd_cleanup_async_ctx is called while num_inflight is 2 (i.e.
elevated by 1, a single inflight callback).
2. mlx5_cmd_cleanup_async_ctx decreases num_inflight to 1.
3. mlx5_cmd_exec_cb_handler is called, decreases num_inflight to 0 and
is about to call wake_up().
4. mlx5_cmd_cleanup_async_ctx calls wait_event, which returns
immediately as the condi
Debian
CVE-2022-50726: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5: F...
vendor_debian·2022
CVE-2022-50726 CVE-2022-50726: linux - In the Linux kernel, the following vulnerability has been resolved: net/mlx5: F...
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix possible use-after-free in async command interface mlx5_cmd_cleanup_async_ctx should return only after all its callback handlers were completed. Before this patch, the below race between mlx5_cmd_cleanup_async_ctx and mlx5_cmd_exec_cb_handler was possible and lead to a use-after-free: 1. mlx5_cmd_cleanup_async_ctx is called while num_inflight is 2 (i.e. elevated by 1, a single inflight callback). 2. mlx5_cmd_cleanup_async_ctx decreases num_inflight to 1. 3. mlx5_cmd_exec_cb_handler is called, decreases num_inflight to 0 and is about to call wake_up(). 4. mlx5_cmd_cleanup_async_ctx calls wait_event, which returns immediately as the condition (num_inflight == 0) holds. 5. mlx5_cmd_cleanup_async_ctx returns. 6.
VulDB
Linux Kernel up to 5.4.222/5.10.152/5.15.76/6.0.6 Async Command Interface wake_up use after free (Nessus ID 279889 / WID-SEC-2025-2929)
vuldb·2026-04-21
CVE-2022-50726 [CRITICAL] Linux Kernel up to 5.4.222/5.10.152/5.15.76/6.0.6 Async Command Interface wake_up use after free (Nessus ID 279889 / WID-SEC-2025-2929)
A vulnerability was found in Linux Kernel up to 5.4.222/5.10.152/5.15.76/6.0.6 and classified as critical. This vulnerability affects the function wake_up of the component Async Command Interface. Executing a manipulation can lead to use after free.
This vulnerability appears as CVE-2022-50726. The attacker needs to be present on the local network. There is no available exploit.
It is suggested to upgrade the affected component.
GHSA
GHSA-gjhx-8fr4-rcc6: In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Fix possible use-after-free in async command interface
mlx5_cmd_cleanu
ghsa_unreviewed·2025-12-24
CVE-2022-50726 GHSA-gjhx-8fr4-rcc6: In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Fix possible use-after-free in async command interface
mlx5_cmd_cleanu
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Fix possible use-after-free in async command interface
mlx5_cmd_cleanup_async_ctx should return only after all its callback
handlers were completed. Before this patch, the below race between
mlx5_cmd_cleanup_async_ctx and mlx5_cmd_exec_cb_handler was possible and
lead to a use-after-free:
1. mlx5_cmd_cleanup_async_ctx is called while num_inflight is 2 (i.e.
elevated by 1, a single inflight callback).
2. mlx5_cmd_cleanup_async_ctx decreases num_inflight to 1.
3. mlx5_cmd_exec_cb_handler is called, decreases num_inflight to 0 and
is about to call wake_up().
4. mlx5_cmd_cleanup_async_ctx calls wait_event, which returns
immediately as the condition (num_inflight == 0) holds.
5. mlx5_cmd_cleanup_async_ctx returns.
OSV
net/mlx5: Fix possible use-after-free in async command interface
osv·2025-12-24
CVE-2022-50726 net/mlx5: Fix possible use-after-free in async command interface
net/mlx5: Fix possible use-after-free in async command interface
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Fix possible use-after-free in async command interface
mlx5_cmd_cleanup_async_ctx should return only after all its callback
handlers were completed. Before this patch, the below race between
mlx5_cmd_cleanup_async_ctx and mlx5_cmd_exec_cb_handler was possible and
lead to a use-after-free:
1. mlx5_cmd_cleanup_async_ctx is called while num_inflight is 2 (i.e.
elevated by 1, a single inflight callback).
2. mlx5_cmd_cleanup_async_ctx decreases num_inflight to 1.
3. mlx5_cmd_exec_cb_handler is called, decreases num_inflight to 0 and
is about to call wake_up().
4. mlx5_cmd_cleanup_async_ctx calls wait_event, which returns
immediately as the condition
OSV
CVE-2022-50726: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix possible use-after-free in async command interface mlx5_cmd_cleanup_
osv·2025-12-24
CVE-2022-50726 CVE-2022-50726: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix possible use-after-free in async command interface mlx5_cmd_cleanup_
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix possible use-after-free in async command interface mlx5_cmd_cleanup_async_ctx should return only after all its callback handlers were completed. Before this patch, the below race between mlx5_cmd_cleanup_async_ctx and mlx5_cmd_exec_cb_handler was possible and lead to a use-after-free: 1. mlx5_cmd_cleanup_async_ctx is called while num_inflight is 2 (i.e. elevated by 1, a single inflight callback). 2. mlx5_cmd_cleanup_async_ctx decreases num_inflight to 1. 3. mlx5_cmd_exec_cb_handler is called, decreases num_inflight to 0 and is about to call wake_up(). 4. mlx5_cmd_cleanup_async_ctx calls wait_event, which returns immediately as the condition (num_inflight == 0) holds. 5. mlx5_cmd_cleanup_async_ctx returns. 6.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2022-50726 kernel: net/mlx5: Fix possible use-after-free in async command interface
bugzilla·2025-12-24
CVE-2022-50726 [MEDIUM] CVE-2022-50726 kernel: net/mlx5: Fix possible use-after-free in async command interface
CVE-2022-50726 kernel: net/mlx5: Fix possible use-after-free in async command interface
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Fix possible use-after-free in async command interface
mlx5_cmd_cleanup_async_ctx should return only after all its callback
handlers were completed. Before this patch, the below race between
mlx5_cmd_cleanup_async_ctx and mlx5_cmd_exec_cb_handler was possible and
lead to a use-after-free:
1. mlx5_cmd_cleanup_async_ctx is called while num_inflight is 2 (i.e.
elevated by 1, a single inflight callback).
2. mlx5_cmd_cleanup_async_ctx decreases num_inflight to 1.
3. mlx5_cmd_exec_cb_handler is called, decreases num_inflight to 0 and
is about to call wake_up().
4. mlx5_cmd_cleanup_async_ctx calls wait_event, which returns
immedi
Wiz
CVE-2022-50726 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2022-50726 CVE-2022-50726 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2022-50726 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Fix possible use-after-free in async command interface
mlx5_cmd_cleanup_async_ctx should return only after all its callback
handlers were completed. Before this patch, the below race between
mlx5_cmd_cleanup_async_ctx and mlx5_cmd_exec_cb_handler was possible and
lead to a use-after-free:
mlx5_cmd_cleanup_async_ctx is called while num_inflight is 2 (i.e.
elevated by 1, a single inflight callback).
mlx5_cmd_cleanup_async_ctx decreases num_inflight to 1.
mlx5_cmd_exec_cb_handler is called, decreases num_inflight to 0 and is about to call wake_up().
mlx5_cmd_cleanup_async_ctx calls wait_event, which returns immediately as the condition (n
https://git.kernel.org/stable/c/0aa3ee1e4e5c9ed5dda11249450d609c3072c54ehttps://git.kernel.org/stable/c/69dd3ad406c49aa69ce4852c15231ac56af8caf9https://git.kernel.org/stable/c/ab3de780c176bb91995c6166a576b370d9726e17https://git.kernel.org/stable/c/bacd22df95147ed673bec4692ab2d4d585935241https://git.kernel.org/stable/c/bbcc06933f35651294ea1e963757502312c2171f
2025-12-24
Published