Vulnerability-Lookup

GHSA-FP64-R8JF-R586

Vulnerability from github – Published: 2025-06-18 12:30 – Updated: 2025-11-17 18:30

Details

In the Linux kernel, the following vulnerability has been resolved:

btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()

In btrfs_relocate_block_group(), the rc is allocated. Then btrfs_relocate_block_group() calls

relocate_block_group() prepare_to_relocate() set_reloc_control()

that assigns rc to the variable fs_info->reloc_ctl. When prepare_to_relocate() returns, it calls

btrfs_commit_transaction() btrfs_start_dirty_block_groups() btrfs_alloc_path() kmem_cache_zalloc()

which may fail for example (or other errors could happen). When the failure occurs, btrfs_relocate_block_group() detects the error and frees rc and doesn't set fs_info->reloc_ctl to NULL. After that, in btrfs_init_reloc_root(), rc is retrieved from fs_info->reloc_ctl and then used, which may cause a use-after-free bug.

This possible bug can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag().

To fix this possible bug, in prepare_to_relocate(), check if btrfs_commit_transaction() fails. If the failure occurs, unset_reloc_control() is called to set fs_info->reloc_ctl to NULL.

The error log in our fault-injection testing is shown as follows:

[ 58.751070] BUG: KASAN: use-after-free in btrfs_init_reloc_root+0x7ca/0x920 [btrfs] ... [ 58.753577] Call Trace: ... [ 58.755800] kasan_report+0x45/0x60 [ 58.756066] btrfs_init_reloc_root+0x7ca/0x920 [btrfs] [ 58.757304] record_root_in_trans+0x792/0xa10 [btrfs] [ 58.757748] btrfs_record_root_in_trans+0x463/0x4f0 [btrfs] [ 58.758231] start_transaction+0x896/0x2950 [btrfs] [ 58.758661] btrfs_defrag_root+0x250/0xc00 [btrfs] [ 58.759083] btrfs_ioctl_defrag+0x467/0xa00 [btrfs] [ 58.759513] btrfs_ioctl+0x3c95/0x114e0 [btrfs] ... [ 58.768510] Allocated by task 23683: [ 58.768777] _kasankmalloc+0xb5/0xf0 [ 58.769069] kmalloc+0x227/0x3d0 [ 58.769325] alloc_reloc_control+0x10a/0x3d0 [btrfs] [ 58.769755] btrfs_relocate_block_group+0x7aa/0x1e20 [btrfs] [ 58.770228] btrfs_relocate_chunk+0xf1/0x760 [btrfs] [ 58.770655] __btrfs_balance+0x1326/0x1f10 [btrfs] [ 58.771071] btrfs_balance+0x3150/0x3d30 [btrfs] [ 58.771472] btrfs_ioctl_balance+0xd84/0x1410 [btrfs] [ 58.771902] btrfs_ioctl+0x4caa/0x114e0 [btrfs] ... [ 58.773337] Freed by task 23683: ... [ 58.774815] kfree+0xda/0x2b0 [ 58.775038] free_reloc_control+0x1d6/0x220 [btrfs] [ 58.775465] btrfs_relocate_block_group+0x115c/0x1e20 [btrfs] [ 58.775944] btrfs_relocate_chunk+0xf1/0x760 [btrfs] [ 58.776369] __btrfs_balance+0x1326/0x1f10 [btrfs] [ 58.776784] btrfs_balance+0x3150/0x3d30 [btrfs] [ 58.777185] btrfs_ioctl_balance+0xd84/0x1410 [btrfs] [ 58.777621] btrfs_ioctl+0x4caa/0x114e0 [btrfs] ...

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-50067"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-18T11:15:35Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: unset reloc control if transaction commit fails in prepare_to_relocate()\n\nIn btrfs_relocate_block_group(), the rc is allocated.  Then\nbtrfs_relocate_block_group() calls\n\nrelocate_block_group()\n  prepare_to_relocate()\n    set_reloc_control()\n\nthat assigns rc to the variable fs_info-\u003ereloc_ctl. When\nprepare_to_relocate() returns, it calls\n\nbtrfs_commit_transaction()\n  btrfs_start_dirty_block_groups()\n    btrfs_alloc_path()\n      kmem_cache_zalloc()\n\nwhich may fail for example (or other errors could happen). When the\nfailure occurs, btrfs_relocate_block_group() detects the error and frees\nrc and doesn\u0027t set fs_info-\u003ereloc_ctl to NULL. After that, in\nbtrfs_init_reloc_root(), rc is retrieved from fs_info-\u003ereloc_ctl and\nthen used, which may cause a use-after-free bug.\n\nThis possible bug can be triggered by calling btrfs_ioctl_balance()\nbefore calling btrfs_ioctl_defrag().\n\nTo fix this possible bug, in prepare_to_relocate(), check if\nbtrfs_commit_transaction() fails. If the failure occurs,\nunset_reloc_control() is called to set fs_info-\u003ereloc_ctl to NULL.\n\nThe error log in our fault-injection testing is shown as follows:\n\n  [   58.751070] BUG: KASAN: use-after-free in btrfs_init_reloc_root+0x7ca/0x920 [btrfs]\n  ...\n  [   58.753577] Call Trace:\n  ...\n  [   58.755800]  kasan_report+0x45/0x60\n  [   58.756066]  btrfs_init_reloc_root+0x7ca/0x920 [btrfs]\n  [   58.757304]  record_root_in_trans+0x792/0xa10 [btrfs]\n  [   58.757748]  btrfs_record_root_in_trans+0x463/0x4f0 [btrfs]\n  [   58.758231]  start_transaction+0x896/0x2950 [btrfs]\n  [   58.758661]  btrfs_defrag_root+0x250/0xc00 [btrfs]\n  [   58.759083]  btrfs_ioctl_defrag+0x467/0xa00 [btrfs]\n  [   58.759513]  btrfs_ioctl+0x3c95/0x114e0 [btrfs]\n  ...\n  [   58.768510] Allocated by task 23683:\n  [   58.768777]  ____kasan_kmalloc+0xb5/0xf0\n  [   58.769069]  __kmalloc+0x227/0x3d0\n  [   58.769325]  alloc_reloc_control+0x10a/0x3d0 [btrfs]\n  [   58.769755]  btrfs_relocate_block_group+0x7aa/0x1e20 [btrfs]\n  [   58.770228]  btrfs_relocate_chunk+0xf1/0x760 [btrfs]\n  [   58.770655]  __btrfs_balance+0x1326/0x1f10 [btrfs]\n  [   58.771071]  btrfs_balance+0x3150/0x3d30 [btrfs]\n  [   58.771472]  btrfs_ioctl_balance+0xd84/0x1410 [btrfs]\n  [   58.771902]  btrfs_ioctl+0x4caa/0x114e0 [btrfs]\n  ...\n  [   58.773337] Freed by task 23683:\n  ...\n  [   58.774815]  kfree+0xda/0x2b0\n  [   58.775038]  free_reloc_control+0x1d6/0x220 [btrfs]\n  [   58.775465]  btrfs_relocate_block_group+0x115c/0x1e20 [btrfs]\n  [   58.775944]  btrfs_relocate_chunk+0xf1/0x760 [btrfs]\n  [   58.776369]  __btrfs_balance+0x1326/0x1f10 [btrfs]\n  [   58.776784]  btrfs_balance+0x3150/0x3d30 [btrfs]\n  [   58.777185]  btrfs_ioctl_balance+0xd84/0x1410 [btrfs]\n  [   58.777621]  btrfs_ioctl+0x4caa/0x114e0 [btrfs]\n  ...",
  "id": "GHSA-fp64-r8jf-r586",
  "modified": "2025-11-17T18:30:23Z",
  "published": "2025-06-18T12:30:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50067"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5d741afed0bac206640cc64d77b97853283cf719"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/78f8c2370e3d33e35f23bdc648653d779aeacb6e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/85f02d6c856b9f3a0acf5219de6e32f58b9778eb"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8e546674031fc1576da501e27a8fd165222e5a37"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b60e862e133f646f19023ece1d476d630a660de1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/dcb11fe0a0a9cca2b7425191b9bf30dc29f2ad0f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ff0e8ed8dfb584575cffc1561f17a1d094e8565b"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2022-50067 (GCVE-0-2022-50067)

Vulnerability from cvelistv5 – Published: 2025-06-18 11:02 – Updated: 2026-05-11 19:12

Title

btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()

Summary

In the Linux kernel, the following vulnerability has been resolved: btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() In btrfs_relocate_block_group(), the rc is allocated. Then btrfs_relocate_block_group() calls relocate_block_group() prepare_to_relocate() set_reloc_control() that assigns rc to the variable fs_info->reloc_ctl. When prepare_to_relocate() returns, it calls btrfs_commit_transaction() btrfs_start_dirty_block_groups() btrfs_alloc_path() kmem_cache_zalloc() which may fail for example (or other errors could happen). When the failure occurs, btrfs_relocate_block_group() detects the error and frees rc and doesn't set fs_info->reloc_ctl to NULL. After that, in btrfs_init_reloc_root(), rc is retrieved from fs_info->reloc_ctl and then used, which may cause a use-after-free bug. This possible bug can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag(). To fix this possible bug, in prepare_to_relocate(), check if btrfs_commit_transaction() fails. If the failure occurs, unset_reloc_control() is called to set fs_info->reloc_ctl to NULL. The error log in our fault-injection testing is shown as follows: [ 58.751070] BUG: KASAN: use-after-free in btrfs_init_reloc_root+0x7ca/0x920 [btrfs] ... [ 58.753577] Call Trace: ... [ 58.755800] kasan_report+0x45/0x60 [ 58.756066] btrfs_init_reloc_root+0x7ca/0x920 [btrfs] [ 58.757304] record_root_in_trans+0x792/0xa10 [btrfs] [ 58.757748] btrfs_record_root_in_trans+0x463/0x4f0 [btrfs] [ 58.758231] start_transaction+0x896/0x2950 [btrfs] [ 58.758661] btrfs_defrag_root+0x250/0xc00 [btrfs] [ 58.759083] btrfs_ioctl_defrag+0x467/0xa00 [btrfs] [ 58.759513] btrfs_ioctl+0x3c95/0x114e0 [btrfs] ... [ 58.768510] Allocated by task 23683: [ 58.768777] ____kasan_kmalloc+0xb5/0xf0 [ 58.769069] __kmalloc+0x227/0x3d0 [ 58.769325] alloc_reloc_control+0x10a/0x3d0 [btrfs] [ 58.769755] btrfs_relocate_block_group+0x7aa/0x1e20 [btrfs] [ 58.770228] btrfs_relocate_chunk+0xf1/0x760 [btrfs] [ 58.770655] __btrfs_balance+0x1326/0x1f10 [btrfs] [ 58.771071] btrfs_balance+0x3150/0x3d30 [btrfs] [ 58.771472] btrfs_ioctl_balance+0xd84/0x1410 [btrfs] [ 58.771902] btrfs_ioctl+0x4caa/0x114e0 [btrfs] ... [ 58.773337] Freed by task 23683: ... [ 58.774815] kfree+0xda/0x2b0 [ 58.775038] free_reloc_control+0x1d6/0x220 [btrfs] [ 58.775465] btrfs_relocate_block_group+0x115c/0x1e20 [btrfs] [ 58.775944] btrfs_relocate_chunk+0xf1/0x760 [btrfs] [ 58.776369] __btrfs_balance+0x1326/0x1f10 [btrfs] [ 58.776784] btrfs_balance+0x3150/0x3d30 [btrfs] [ 58.777185] btrfs_ioctl_balance+0xd84/0x1410 [btrfs] [ 58.777621] btrfs_ioctl+0x4caa/0x114e0 [btrfs] ...

Severity

No CVSS data available.

Assigner

Linux mitre root Scorecard

References

7 references

URL	Tags
https://git.kernel.org/stable/c/ff0e8ed8dfb584575…
https://git.kernel.org/stable/c/dcb11fe0a0a9cca2b…
https://git.kernel.org/stable/c/8e546674031fc1576…
https://git.kernel.org/stable/c/b60e862e133f646f1…
https://git.kernel.org/stable/c/78f8c2370e3d33e35…
https://git.kernel.org/stable/c/5d741afed0bac2066…
https://git.kernel.org/stable/c/85f02d6c856b9f3a0…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1a5353475df8fcaf200fecc9e961a3900d15e891 , < ff0e8ed8dfb584575cffc1561f17a1d094e8565b (git) Affected: 499d29bf151951399367ba83645abfdb429a3af9 , < dcb11fe0a0a9cca2b7425191b9bf30dc29f2ad0f (git) Affected: 4223d91ca1b5bf3928e5722c3c6b3fdb49250ab3 , < 8e546674031fc1576da501e27a8fd165222e5a37 (git) Affected: 6f371623f315c26100e603c2e8837cdbe130f9e0 , < b60e862e133f646f19023ece1d476d630a660de1 (git) Affected: fb686c6824dd6294ca772b92424b8fba666e7d00 , < 78f8c2370e3d33e35f23bdc648653d779aeacb6e (git) Affected: fb686c6824dd6294ca772b92424b8fba666e7d00 , < 5d741afed0bac206640cc64d77b97853283cf719 (git) Affected: fb686c6824dd6294ca772b92424b8fba666e7d00 , < 85f02d6c856b9f3a0acf5219de6e32f58b9778eb (git)
Linux	Linux	Affected: 5.13 Unaffected: 0 , < 5.13 (semver) Unaffected: 5.15.63 , ≤ 5.15.* (semver) Unaffected: 5.19.4 , ≤ 5.19.* (semver) Unaffected: 6.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/relocation.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ff0e8ed8dfb584575cffc1561f17a1d094e8565b",
              "status": "affected",
              "version": "1a5353475df8fcaf200fecc9e961a3900d15e891",
              "versionType": "git"
            },
            {
              "lessThan": "dcb11fe0a0a9cca2b7425191b9bf30dc29f2ad0f",
              "status": "affected",
              "version": "499d29bf151951399367ba83645abfdb429a3af9",
              "versionType": "git"
            },
            {
              "lessThan": "8e546674031fc1576da501e27a8fd165222e5a37",
              "status": "affected",
              "version": "4223d91ca1b5bf3928e5722c3c6b3fdb49250ab3",
              "versionType": "git"
            },
            {
              "lessThan": "b60e862e133f646f19023ece1d476d630a660de1",
              "status": "affected",
              "version": "6f371623f315c26100e603c2e8837cdbe130f9e0",
              "versionType": "git"
            },
            {
              "lessThan": "78f8c2370e3d33e35f23bdc648653d779aeacb6e",
              "status": "affected",
              "version": "fb686c6824dd6294ca772b92424b8fba666e7d00",
              "versionType": "git"
            },
            {
              "lessThan": "5d741afed0bac206640cc64d77b97853283cf719",
              "status": "affected",
              "version": "fb686c6824dd6294ca772b92424b8fba666e7d00",
              "versionType": "git"
            },
            {
              "lessThan": "85f02d6c856b9f3a0acf5219de6e32f58b9778eb",
              "status": "affected",
              "version": "fb686c6824dd6294ca772b92424b8fba666e7d00",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/relocation.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.63",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.63",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.4",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: unset reloc control if transaction commit fails in prepare_to_relocate()\n\nIn btrfs_relocate_block_group(), the rc is allocated.  Then\nbtrfs_relocate_block_group() calls\n\nrelocate_block_group()\n  prepare_to_relocate()\n    set_reloc_control()\n\nthat assigns rc to the variable fs_info-\u003ereloc_ctl. When\nprepare_to_relocate() returns, it calls\n\nbtrfs_commit_transaction()\n  btrfs_start_dirty_block_groups()\n    btrfs_alloc_path()\n      kmem_cache_zalloc()\n\nwhich may fail for example (or other errors could happen). When the\nfailure occurs, btrfs_relocate_block_group() detects the error and frees\nrc and doesn\u0027t set fs_info-\u003ereloc_ctl to NULL. After that, in\nbtrfs_init_reloc_root(), rc is retrieved from fs_info-\u003ereloc_ctl and\nthen used, which may cause a use-after-free bug.\n\nThis possible bug can be triggered by calling btrfs_ioctl_balance()\nbefore calling btrfs_ioctl_defrag().\n\nTo fix this possible bug, in prepare_to_relocate(), check if\nbtrfs_commit_transaction() fails. If the failure occurs,\nunset_reloc_control() is called to set fs_info-\u003ereloc_ctl to NULL.\n\nThe error log in our fault-injection testing is shown as follows:\n\n  [   58.751070] BUG: KASAN: use-after-free in btrfs_init_reloc_root+0x7ca/0x920 [btrfs]\n  ...\n  [   58.753577] Call Trace:\n  ...\n  [   58.755800]  kasan_report+0x45/0x60\n  [   58.756066]  btrfs_init_reloc_root+0x7ca/0x920 [btrfs]\n  [   58.757304]  record_root_in_trans+0x792/0xa10 [btrfs]\n  [   58.757748]  btrfs_record_root_in_trans+0x463/0x4f0 [btrfs]\n  [   58.758231]  start_transaction+0x896/0x2950 [btrfs]\n  [   58.758661]  btrfs_defrag_root+0x250/0xc00 [btrfs]\n  [   58.759083]  btrfs_ioctl_defrag+0x467/0xa00 [btrfs]\n  [   58.759513]  btrfs_ioctl+0x3c95/0x114e0 [btrfs]\n  ...\n  [   58.768510] Allocated by task 23683:\n  [   58.768777]  ____kasan_kmalloc+0xb5/0xf0\n  [   58.769069]  __kmalloc+0x227/0x3d0\n  [   58.769325]  alloc_reloc_control+0x10a/0x3d0 [btrfs]\n  [   58.769755]  btrfs_relocate_block_group+0x7aa/0x1e20 [btrfs]\n  [   58.770228]  btrfs_relocate_chunk+0xf1/0x760 [btrfs]\n  [   58.770655]  __btrfs_balance+0x1326/0x1f10 [btrfs]\n  [   58.771071]  btrfs_balance+0x3150/0x3d30 [btrfs]\n  [   58.771472]  btrfs_ioctl_balance+0xd84/0x1410 [btrfs]\n  [   58.771902]  btrfs_ioctl+0x4caa/0x114e0 [btrfs]\n  ...\n  [   58.773337] Freed by task 23683:\n  ...\n  [   58.774815]  kfree+0xda/0x2b0\n  [   58.775038]  free_reloc_control+0x1d6/0x220 [btrfs]\n  [   58.775465]  btrfs_relocate_block_group+0x115c/0x1e20 [btrfs]\n  [   58.775944]  btrfs_relocate_chunk+0xf1/0x760 [btrfs]\n  [   58.776369]  __btrfs_balance+0x1326/0x1f10 [btrfs]\n  [   58.776784]  btrfs_balance+0x3150/0x3d30 [btrfs]\n  [   58.777185]  btrfs_ioctl_balance+0xd84/0x1410 [btrfs]\n  [   58.777621]  btrfs_ioctl+0x4caa/0x114e0 [btrfs]\n  ..."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:12:13.557Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ff0e8ed8dfb584575cffc1561f17a1d094e8565b"
        },
        {
          "url": "https://git.kernel.org/stable/c/dcb11fe0a0a9cca2b7425191b9bf30dc29f2ad0f"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e546674031fc1576da501e27a8fd165222e5a37"
        },
        {
          "url": "https://git.kernel.org/stable/c/b60e862e133f646f19023ece1d476d630a660de1"
        },
        {
          "url": "https://git.kernel.org/stable/c/78f8c2370e3d33e35f23bdc648653d779aeacb6e"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d741afed0bac206640cc64d77b97853283cf719"
        },
        {
          "url": "https://git.kernel.org/stable/c/85f02d6c856b9f3a0acf5219de6e32f58b9778eb"
        }
      ],
      "title": "btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50067",
    "datePublished": "2025-06-18T11:02:13.127Z",
    "dateReserved": "2025-06-18T10:57:27.405Z",
    "dateUpdated": "2026-05-11T19:12:13.557Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-FP64-R8JF-R586

CVE-2022-50067 (GCVE-0-2022-50067)

Tags

Sightings

Nomenclature

Related by attack behaviour