{"id":"CVE-2022-50022","state":"PUBLISHED","title":"drivers:md:fix a potential use-after-free bug","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers:md:fix a potential use-after-free bug\n\nIn line 2884, \"raid5_release_stripe(sh);\" drops the reference to sh and\nmay cause sh to be released. However, sh is subsequently used in lines\n2886 \"if (sh->batch_head && sh != sh->batch_head)\". This may result in an\nuse-after-free bug.\n\nIt can be fixed by moving \"raid5_release_stripe(sh);\" to the bottom of\nthe function.","publishedAt":"2025-06-18T11:01:25.965Z","updatedAt":"2026-08-05T08:57:10.904Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"59fc630b8b5f9f21c8ce3ba153341c107dce1b0c","status":"affected","lessThan":"7470a4314b239e9a9580f248fdf4c9a92805490e","versionType":"git"},{"version":"59fc630b8b5f9f21c8ce3ba153341c107dce1b0c","status":"affected","lessThan":"09cf99bace7789d91caa8d10fbcfc8b2fb35857f","versionType":"git"},{"version":"59fc630b8b5f9f21c8ce3ba153341c107dce1b0c","status":"affected","lessThan":"e5b3dd2d92c4511e81f6e4ec9c5bb7ad25e03d13","versionType":"git"},{"version":"59fc630b8b5f9f21c8ce3ba153341c107dce1b0c","status":"affected","lessThan":"f5d46f1b47f65da1faf468277b261eb78c8e25b5","versionType":"git"},{"version":"59fc630b8b5f9f21c8ce3ba153341c107dce1b0c","status":"affected","lessThan":"5d8325fd15892c8ab1146edc1d7ed8463de39636","versionType":"git"},{"version":"59fc630b8b5f9f21c8ce3ba153341c107dce1b0c","status":"affected","lessThan":"d9b94c3ace549433de8a93eeb27b0391fc8ac406","versionType":"git"},{"version":"59fc630b8b5f9f21c8ce3ba153341c107dce1b0c","status":"affected","lessThan":"eb3a4f73f43f839df981dda5859e8e075067a360","versionType":"git"},{"version":"59fc630b8b5f9f21c8ce3ba153341c107dce1b0c","status":"affected","lessThan":"104212471b1c1817b311771d817fb692af983173","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/md/raid5.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.1","versionType":"semver"},{"version":"4.9.326","status":"unaffected","lessThanOrEqual":"4.9.*","versionType":"semver"},{"version":"4.14.291","status":"unaffected","lessThanOrEqual":"4.14.*","versionType":"semver"},{"version":"4.19.256","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.211","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.138","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.63","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"5.19.4","status":"unaffected","lessThanOrEqual":"5.19.*","versionType":"semver"},{"version":"6.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/md/raid5.c"]}],"references":["https://git.kernel.org/stable/c/7470a4314b239e9a9580f248fdf4c9a92805490e","https://git.kernel.org/stable/c/09cf99bace7789d91caa8d10fbcfc8b2fb35857f","https://git.kernel.org/stable/c/e5b3dd2d92c4511e81f6e4ec9c5bb7ad25e03d13","https://git.kernel.org/stable/c/f5d46f1b47f65da1faf468277b261eb78c8e25b5","https://git.kernel.org/stable/c/5d8325fd15892c8ab1146edc1d7ed8463de39636","https://git.kernel.org/stable/c/d9b94c3ace549433de8a93eeb27b0391fc8ac406","https://git.kernel.org/stable/c/eb3a4f73f43f839df981dda5859e8e075067a360","https://git.kernel.org/stable/c/104212471b1c1817b311771d817fb692af983173"],"weaknesses":[],"ingestedAt":"2026-10-29T20:05:26.763Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/50xxx/CVE-2022-50022.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-50022","state":"PUBLISHED","datePublished":"2025-06-18T11:01:25.965Z","dateUpdated":"2026-08-05T08:57:10.904Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-06-18T10:57:27.394Z"},"containers":{"cna":{"title":"drivers:md:fix a potential use-after-free bug","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers:md:fix a potential use-after-free bug\n\nIn line 2884, \"raid5_release_stripe(sh);\" drops the reference to sh and\nmay cause sh to be released. However, sh is subsequently used in lines\n2886 \"if (sh->batch_head && sh != sh->batch_head)\". This may result in an\nuse-after-free bug.\n\nIt can be fixed by moving \"raid5_release_stripe(sh);\" to the bottom of\nthe function."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"59fc630b8b5f9f21c8ce3ba153341c107dce1b0c","status":"affected","lessThan":"7470a4314b239e9a9580f248fdf4c9a92805490e","versionType":"git"},{"version":"59fc630b8b5f9f21c8ce3ba153341c107dce1b0c","status":"affected","lessThan":"09cf99bace7789d91caa8d10fbcfc8b2fb35857f","versionType":"git"},{"version":"59fc630b8b5f9f21c8ce3ba153341c107dce1b0c","status":"affected","lessThan":"e5b3dd2d92c4511e81f6e4ec9c5bb7ad25e03d13","versionType":"git"},{"version":"59fc630b8b5f9f21c8ce3ba153341c107dce1b0c","status":"affected","lessThan":"f5d46f1b47f65da1faf468277b261eb78c8e25b5","versionType":"git"},{"version":"59fc630b8b5f9f21c8ce3ba153341c107dce1b0c","status":"affected","lessThan":"5d8325fd15892c8ab1146edc1d7ed8463de39636","versionType":"git"},{"version":"59fc630b8b5f9f21c8ce3ba153341c107dce1b0c","status":"affected","lessThan":"d9b94c3ace549433de8a93eeb27b0391fc8ac406","versionType":"git"},{"version":"59fc630b8b5f9f21c8ce3ba153341c107dce1b0c","status":"affected","lessThan":"eb3a4f73f43f839df981dda5859e8e075067a360","versionType":"git"},{"version":"59fc630b8b5f9f21c8ce3ba153341c107dce1b0c","status":"affected","lessThan":"104212471b1c1817b311771d817fb692af983173","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/md/raid5.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.1","versionType":"semver"},{"version":"4.9.326","status":"unaffected","lessThanOrEqual":"4.9.*","versionType":"semver"},{"version":"4.14.291","status":"unaffected","lessThanOrEqual":"4.14.*","versionType":"semver"},{"version":"4.19.256","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.211","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.138","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.63","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"5.19.4","status":"unaffected","lessThanOrEqual":"5.19.*","versionType":"semver"},{"version":"6.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/md/raid5.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/7470a4314b239e9a9580f248fdf4c9a92805490e"},{"url":"https://git.kernel.org/stable/c/09cf99bace7789d91caa8d10fbcfc8b2fb35857f"},{"url":"https://git.kernel.org/stable/c/e5b3dd2d92c4511e81f6e4ec9c5bb7ad25e03d13"},{"url":"https://git.kernel.org/stable/c/f5d46f1b47f65da1faf468277b261eb78c8e25b5"},{"url":"https://git.kernel.org/stable/c/5d8325fd15892c8ab1146edc1d7ed8463de39636"},{"url":"https://git.kernel.org/stable/c/d9b94c3ace549433de8a93eeb27b0391fc8ac406"},{"url":"https://git.kernel.org/stable/c/eb3a4f73f43f839df981dda5859e8e075067a360"},{"url":"https://git.kernel.org/stable/c/104212471b1c1817b311771d817fb692af983173"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is the md/raid5 local write-completion callback (raid5_end_write_request), reached via writes to a RAID5/6 array or a filesystem on it through md_submit_bio → raid5_make_request → ops_run_io; it does not parse network protocol input.\nAC:L - An unprivileged attacker can drive full-stripe sequential writes that enable stripe batching and concurrent I/O to pressure stripe reclaim; per kernel CNA guidance, use-after-free bugs are AC:L unless a race is wholly outside attacker influence.\nPR:L - md_submit_bio/raid5 I/O paths perform no capability checks; any unprivileged local user who can write a file on a RAID5/6-backed filesystem (typical NAS/server deployment) triggers the completion path without init-namespace root.\nUI:N - The attacker’s own write syscalls generate the batched stripe I/O whose completion hits the buggy release-then-use sequence; no separate victim action is required.\nS:U - The use-after-free corrupts kernel stripe_head heap state within the same host kernel authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - Use-after-free of stripe_head lets an attacker reclaim and spray the freed object, then observe or control subsequent reads of sh->batch_head and related fields, yielding a kernel information-disclosure primitive.\nI:H - Reclaiming the freed stripe_head and then calling raid5_release_stripe on a attacker-influenced batch_head pointer provides a write/refcount primitive against kernel heap objects, enabling corruption and control-flow hijacking.\nA:H - Use-after-free on a live stripe_head in the RAID5 write-completion path causes kernel oops/panic or storage-stack corruption, taking down the array and potentially the machine."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T08:57:10.904Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1","versionEndExcluding":"4.9.326"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1","versionEndExcluding":"4.14.291"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1","versionEndExcluding":"4.19.256"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1","versionEndExcluding":"5.4.211"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1","versionEndExcluding":"5.10.138"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1","versionEndExcluding":"5.15.63"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1","versionEndExcluding":"5.19.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1","versionEndExcluding":"6.0"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}