CVE-2022-50219— bpf: Fix KASAN use-after-free Read in compute_effective_progs
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1499 · Endpoint Denial of ServiceAffected Version Matrix 12
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | af6eea57437a830293eab56246b6025cc7d46ee7< 3527e3cbb84d8868c4d4e91ba55915f96d39ec3d | affected |
af6eea57437a830293eab56246b6025cc7d46ee7< 1f8ca9c40e6222ce431e9ba5dae3cccce8ef9443 | affected | ||
af6eea57437a830293eab56246b6025cc7d46ee7< 6336388715afa419cc97d0255bda3bba1b96b7ca | affected | ||
af6eea57437a830293eab56246b6025cc7d46ee7< be001f9da71eaa3b61e186fb88bde3279728bdca | affected | ||
af6eea57437a830293eab56246b6025cc7d46ee7< 4c46091ee985ae84c60c5e95055d779fcd291d87 | affected | ||
5.7 | affected | ||
< 5.7 | unaffected | ||
5.10.138≤ 5.10.* | unaffected | ||
| … +4 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-50219
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
bpf: Fix KASAN use-after-free Read in compute_effective_progs
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix KASAN use-after-free Read in compute_effective_progs Syzbot found a Use After Free bug in compute_effective_progs(). The reproducer creates a number of BPF links, and causes a fault injected alloc to fail, while calling bpf_link_detach on them. Link detach triggers the link to be freed by bpf_link_free(), which calls __cgroup_bpf_detach() and update_effective_progs(). If the memory allocation in this function fails, the function restores the pointer to the bpf_cgroup_link on the cgroup list, but the memory gets freed just after it returns. After this, every subsequent call to update_effective_progs() causes this already deallocated pointer to be dereferenced in prog_list_length(), and triggers KASAN UAF error. To fix this issue don't preserve the pointer to the prog or link in the list, but remove it and replace it with a dummy prog without shrinking the table. The subsequent call to __cgroup_bpf_detach() or __cgroup_bpf_detach() will correct it.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于compute_effective_progs中释放后重用，可能导致内存损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-50219
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-50219
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-06-18 · 362 CVEs total
| CVE-2025-38075 | 9.8 CRITICAL | scsi: target: iscsi: Fix timeout on deleted connection |
| CVE-2022-50098 | 8.8 HIGH | scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts |
| CVE-2025-38052 | 8.8 HIGH | net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done |
| CVE-2022-49934 | 8.8 HIGH | wifi: mac80211: Fix UAF in ieee80211_scan_rx() |
| CVE-2022-50164 | 8.8 HIGH | wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue |
| CVE-2025-38016 | 8.8 HIGH | HID: bpf: abort dispatch if device destroyed |
| CVE-2025-38074 | 8.8 HIGH | vhost-scsi: protect vq->log_used with vq->mutex |
| CVE-2022-49974 | 8.8 HIGH | HID: nintendo: fix rumble worker null pointer deref |
| CVE-2022-49968 | 8.0 HIGH | ieee802154/adf7242: defer destroy_workqueue call |
| CVE-2022-49939 | 7.8 HIGH | binder: fix UAF of ref->proc caused by race condition |
| CVE-2022-49948 | 7.8 HIGH | vt: Clear selection before changing the font |
| CVE-2022-50028 | 7.8 HIGH | gadgetfs: ep_io - wait until IRQ finishes |
| CVE-2022-49935 | 7.8 HIGH | dma-buf/dma-resv: check if the new fence is really later |
| CVE-2025-38082 | 7.8 HIGH | gpio: virtuser: fix potential out-of-bound write |
| CVE-2025-38080 | 7.8 HIGH | drm/amd/display: Increase block_sequence array size |
| CVE-2025-38079 | 7.8 HIGH | crypto: algif_hash - fix double free in hash_accept |
| CVE-2025-38078 | 7.8 HIGH | ALSA: pcm: Fix race of buffer access at PCM OSS layer |
| CVE-2025-38060 | 7.8 HIGH | bpf: copy_verifier_state() should copy 'loop_entry' field |
| CVE-2025-38062 | 7.8 HIGH | genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie |
| CVE-2022-50101 | 7.8 HIGH | video: fbdev: vt8623fb: Check the size of screen before memset_io() |
Showing top 20 of 362 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-74578
crypto: algif_skcipher - force synchronous processing on tre - CVE-2026-74577
net: mpls: initialize rtm_tos in mpls_getroute() - CVE-2026-74576
mm/slab: prevent unbounded recursion in free path with new k - CVE-2026-74574
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev - CVE-2026-74575
thunderbolt: Prevent XDomain delayed work use-after-free on
Same vendor: Linux
- CVE-2026-74578
crypto: algif_skcipher - force synchronous processing on tre - CVE-2026-74577
net: mpls: initialize rtm_tos in mpls_getroute() - CVE-2026-74576
mm/slab: prevent unbounded recursion in free path with new k - CVE-2026-74574
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev - CVE-2026-74575
thunderbolt: Prevent XDomain delayed work use-after-free on
V. Comments for CVE-2022-50219
No comments yet