Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2022-50341— cifs: fix oops during encryption

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于加密过程中内存权限处理不当，可能导致内核崩溃。

CVSS 7.8 · High EPSS 0.11% · P1 Updated Aug 05, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 14

Vendor	Product	Version Range	Status
Linux	Linux	`026e93dc0a3eefb0be060bcb9ecd8d7a7fd5c398< e8e2861cc3258dbe407d01ea8c59bb5a53132301`	affected
		`026e93dc0a3eefb0be060bcb9ecd8d7a7fd5c398< fe6ea044c4f05706cb71040055b1c70c6c8275e0`	affected
		`026e93dc0a3eefb0be060bcb9ecd8d7a7fd5c398< bf0543b93740916ee91956f9a63da6fc0d79daaa`	affected
		`026e93dc0a3eefb0be060bcb9ecd8d7a7fd5c398< a13e51760703f71c25d5fc1f4a62dfa4b0cc80e9`	affected
		`026e93dc0a3eefb0be060bcb9ecd8d7a7fd5c398< e8d16a54842d609fd4a3ed2d81d4333d6329aa94`	affected
		`026e93dc0a3eefb0be060bcb9ecd8d7a7fd5c398< f7f291e14dde32a07b1f0aa06921d28f875a7b54`	affected
		`4.11`	affected
		`< 4.11`	unaffected
… +6 more rows

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-50341

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

cifs: fix oops during encryption

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: cifs: fix oops during encryption When running xfstests against Azure the following oops occurred on an arm64 system Unable to handle kernel write to read-only memory at virtual address ffff0001221cf000 Mem abort info: ESR = 0x9600004f EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x0f: level 3 permission fault Data abort info: ISV = 0, ISS = 0x0000004f CM = 0, WnR = 1 swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000294f3000 [ffff0001221cf000] pgd=18000001ffff8003, p4d=18000001ffff8003, pud=18000001ff82e003, pmd=18000001ff71d003, pte=00600001221cf787 Internal error: Oops: 9600004f [#1] PREEMPT SMP ... pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--) pc : __memcpy+0x40/0x230 lr : scatterwalk_copychunks+0xe0/0x200 sp : ffff800014e92de0 x29: ffff800014e92de0 x28: ffff000114f9de80 x27: 0000000000000008 x26: 0000000000000008 x25: ffff800014e92e78 x24: 0000000000000008 x23: 0000000000000001 x22: 0000040000000000 x21: ffff000000000000 x20: 0000000000000001 x19: ffff0001037c4488 x18: 0000000000000014 x17: 235e1c0d6efa9661 x16: a435f9576b6edd6c x15: 0000000000000058 x14: 0000000000000001 x13: 0000000000000008 x12: ffff000114f2e590 x11: ffffffffffffffff x10: 0000040000000000 x9 : ffff8000105c3580 x8 : 2e9413b10000001a x7 : 534b4410fb86b005 x6 : 534b4410fb86b005 x5 : ffff0001221cf008 x4 : ffff0001037c4490 x3 : 0000000000000001 x2 : 0000000000000008 x1 : ffff0001037c4488 x0 : ffff0001221cf000 Call trace: __memcpy+0x40/0x230 scatterwalk_map_and_copy+0x98/0x100 crypto_ccm_encrypt+0x150/0x180 crypto_aead_encrypt+0x2c/0x40 crypt_message+0x750/0x880 smb3_init_transform_rq+0x298/0x340 smb_send_rqst.part.11+0xd8/0x180 smb_send_rqst+0x3c/0x100 compound_send_recv+0x534/0xbc0 smb2_query_info_compound+0x32c/0x440 smb2_set_ea+0x438/0x4c0 cifs_xattr_set+0x5d4/0x7c0 This is because in scatterwalk_copychunks(), we attempted to write to a buffer (@sign) that was allocated in the stack (vmalloc area) by crypt_message() and thus accessing its remaining 8 (x2) bytes ended up crossing a page boundary. To simply fix it, we could just pass @sign kmalloc'd from crypt_message() and then we're done. Luckily, we don't seem to pass any other vmalloc'd buffers in smb_rqst::rq_iov... Instead, let's map the correct pages and offsets from vmalloc buffers as well in cifs_sg_set_buf() and then avoiding such oopses.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Vulnerability Title

Linux kernel 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于加密过程中内存权限处理不当，可能导致内核崩溃。

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	026e93dc0a3eefb0be060bcb9ecd8d7a7fd5c398 ~ e8e2861cc3258dbe407d01ea8c59bb5a53132301	-
Linux	Linux	4.11	-

II. Public POCs for CVE-2022-50341

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2022-50341

请登录查看更多情报信息。

https://www.cve.org/CVERecord?id=CVE-2022-50341

Same Patch Batch · Linux · 2025-09-16 · 115 CVEs total

CVE-2022-50350	9.8 CRITICAL	scsi: target: iscsi: Fix a race condition between login_work and the login thread
CVE-2025-39806	8.8 HIGH	HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()
CVE-2023-53305	8.8 HIGH	Bluetooth: L2CAP: Fix use-after-free
CVE-2025-39827	8.8 HIGH	net: rose: include node references in rose_neigh refcount
CVE-2025-39826	8.8 HIGH	net: rose: convert 'use' field to refcount_t
CVE-2023-53297	8.8 HIGH	Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp
CVE-2023-53315	8.8 HIGH	wifi: ath11k: Fix SKB corruption in REO destination ring
CVE-2023-53322	8.8 HIGH	scsi: qla2xxx: Wait for io return on terminate rport
CVE-2025-39809	8.4 HIGH	HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length
CVE-2023-53333	8.2 HIGH	netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
CVE-2025-39818	7.8 HIGH	HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save
CVE-2025-39810	7.8 HIGH	bnxt_en: Fix memory corruption when FW resources change during ifdown
CVE-2023-53311	7.8 HIGH	nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
CVE-2023-53314	7.8 HIGH	fbdev/ep93xx-fb: Do not assign to struct fb_info.dev
CVE-2025-39815	7.8 HIGH	RISC-V: KVM: fix stack overrun when loading vlenb
CVE-2023-53286	7.8 HIGH	RDMA/mlx5: Return the firmware result upon destroying QP/RQ
CVE-2022-50339	7.8 HIGH	Bluetooth: avoid hci_dev_test_and_set_flag() in mgmt_init_hdev()
CVE-2023-53274	7.8 HIGH	clk: mediatek: mt8183: Add back SSPM related clocks
CVE-2023-53263	7.8 HIGH	drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create
CVE-2023-53331	7.8 HIGH	pstore/ram: Check start of empty przs during init

Showing top 20 of 115 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux

V. Comments for CVE-2022-50341

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2022-50341— cifs: fix oops during encryption

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 14

I. Basic Information for CVE-2022-50341

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2022-50341

III. Intelligence Information for CVE-2022-50341

Same Patch Batch · Linux · 2025-09-16 · 115 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2022-50341

Leave a comment