GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50211 (GCVE-0-2022-50211)

Vulnerability from cvelistv5 – Published: 2025-06-18 11:03 – Updated: 2026-05-11 19:14
VLAI
Title
md-raid10: fix KASAN warning
Summary
In the Linux kernel, the following vulnerability has been resolved: md-raid10: fix KASAN warning There's a KASAN warning in raid10_remove_disk when running the lvm test lvconvert-raid-reshape.sh. We fix this warning by verifying that the value "number" is valid. BUG: KASAN: slab-out-of-bounds in raid10_remove_disk+0x61/0x2a0 [raid10] Read of size 8 at addr ffff889108f3d300 by task mdX_raid10/124682 CPU: 3 PID: 124682 Comm: mdX_raid10 Not tainted 5.19.0-rc6 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report.cold+0x45/0x57a ? __lock_text_start+0x18/0x18 ? raid10_remove_disk+0x61/0x2a0 [raid10] kasan_report+0xa8/0xe0 ? raid10_remove_disk+0x61/0x2a0 [raid10] raid10_remove_disk+0x61/0x2a0 [raid10] Buffer I/O error on dev dm-76, logical block 15344, async page read ? __mutex_unlock_slowpath.constprop.0+0x1e0/0x1e0 remove_and_add_spares+0x367/0x8a0 [md_mod] ? super_written+0x1c0/0x1c0 [md_mod] ? mutex_trylock+0xac/0x120 ? _raw_spin_lock+0x72/0xc0 ? _raw_spin_lock_bh+0xc0/0xc0 md_check_recovery+0x848/0x960 [md_mod] raid10d+0xcf/0x3360 [raid10] ? sched_clock_cpu+0x185/0x1a0 ? rb_erase+0x4d4/0x620 ? var_wake_function+0xe0/0xe0 ? psi_group_change+0x411/0x500 ? preempt_count_sub+0xf/0xc0 ? _raw_spin_lock_irqsave+0x78/0xc0 ? __lock_text_start+0x18/0x18 ? raid10_sync_request+0x36c0/0x36c0 [raid10] ? preempt_count_sub+0xf/0xc0 ? _raw_spin_unlock_irqrestore+0x19/0x40 ? del_timer_sync+0xa9/0x100 ? try_to_del_timer_sync+0xc0/0xc0 ? _raw_spin_lock_irqsave+0x78/0xc0 ? __lock_text_start+0x18/0x18 ? _raw_spin_unlock_irq+0x11/0x24 ? __list_del_entry_valid+0x68/0xa0 ? finish_wait+0xa3/0x100 md_thread+0x161/0x260 [md_mod] ? unregister_md_personality+0xa0/0xa0 [md_mod] ? _raw_spin_lock_irqsave+0x78/0xc0 ? prepare_to_wait_event+0x2c0/0x2c0 ? unregister_md_personality+0xa0/0xa0 [md_mod] kthread+0x148/0x180 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 124495: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x80/0xa0 setup_conf+0x140/0x5c0 [raid10] raid10_run+0x4cd/0x740 [raid10] md_run+0x6f9/0x1300 [md_mod] raid_ctr+0x2531/0x4ac0 [dm_raid] dm_table_add_target+0x2b0/0x620 [dm_mod] table_load+0x1c8/0x400 [dm_mod] ctl_ioctl+0x29e/0x560 [dm_mod] dm_compat_ctl_ioctl+0x7/0x20 [dm_mod] __do_compat_sys_ioctl+0xfa/0x160 do_syscall_64+0x90/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0x9e/0xc0 kvfree_call_rcu+0x84/0x480 timerfd_release+0x82/0x140 L __fput+0xfa/0x400 task_work_run+0x80/0xc0 exit_to_user_mode_prepare+0x155/0x160 syscall_exit_to_user_mode+0x12/0x40 do_syscall_64+0x42/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Second to last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0x9e/0xc0 kvfree_call_rcu+0x84/0x480 timerfd_release+0x82/0x140 __fput+0xfa/0x400 task_work_run+0x80/0xc0 exit_to_user_mode_prepare+0x155/0x160 syscall_exit_to_user_mode+0x12/0x40 do_syscall_64+0x42/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The buggy address belongs to the object at ffff889108f3d200 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 0 bytes to the right of 256-byte region [ffff889108f3d200, ffff889108f3d300) The buggy address belongs to the physical page: page:000000007ef2a34c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1108f3c head:000000007ef2a34c order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=2) raw: 4000000000010200 0000000000000000 dead000000000001 ffff889100042b40 raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff889108f3d200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff889108f3d280: 00 00 ---truncated---
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b8321b68d1445f308324517e45fb0a5c2b48e271 , < 75fbd370a2cec9e92f48285bd90735ed0c837f52 (git)
Affected: b8321b68d1445f308324517e45fb0a5c2b48e271 , < bcbdc26a44aba488d2f7122f2d66801bccb74733 (git)
Affected: b8321b68d1445f308324517e45fb0a5c2b48e271 , < 7a6ccc8fa192fd357c2d5d4c6ce67c834a179e23 (git)
Affected: b8321b68d1445f308324517e45fb0a5c2b48e271 , < ce839b9331c11780470f3d727b6fe3c2794a4620 (git)
Affected: b8321b68d1445f308324517e45fb0a5c2b48e271 , < 5fd4ffa2372a41361d2bdd27ea5730e4e673240c (git)
Affected: b8321b68d1445f308324517e45fb0a5c2b48e271 , < 0f4d18cbea4a6e37a05fd8ee2887439f85211110 (git)
Affected: b8321b68d1445f308324517e45fb0a5c2b48e271 , < bf30b9ba09b0ac2a10f04dce2b0835ec4d178aa6 (git)
Affected: b8321b68d1445f308324517e45fb0a5c2b48e271 , < 5f57843565131bb782388f9d993f9ee8f453dee1 (git)
Affected: b8321b68d1445f308324517e45fb0a5c2b48e271 , < d17f744e883b2f8d13cca252d71cfe8ace346f7d (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.3
Unaffected: 0 , < 3.3 (semver)
Unaffected: 4.9.326 , ≤ 4.9.* (semver)
Unaffected: 4.14.291 , ≤ 4.14.* (semver)
Unaffected: 4.19.256 , ≤ 4.19.* (semver)
Unaffected: 5.4.211 , ≤ 5.4.* (semver)
Unaffected: 5.10.137 , ≤ 5.10.* (semver)
Unaffected: 5.15.61 , ≤ 5.15.* (semver)
Unaffected: 5.18.18 , ≤ 5.18.* (semver)
Unaffected: 5.19.2 , ≤ 5.19.* (semver)
Unaffected: 6.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/raid10.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "75fbd370a2cec9e92f48285bd90735ed0c837f52",
              "status": "affected",
              "version": "b8321b68d1445f308324517e45fb0a5c2b48e271",
              "versionType": "git"
            },
            {
              "lessThan": "bcbdc26a44aba488d2f7122f2d66801bccb74733",
              "status": "affected",
              "version": "b8321b68d1445f308324517e45fb0a5c2b48e271",
              "versionType": "git"
            },
            {
              "lessThan": "7a6ccc8fa192fd357c2d5d4c6ce67c834a179e23",
              "status": "affected",
              "version": "b8321b68d1445f308324517e45fb0a5c2b48e271",
              "versionType": "git"
            },
            {
              "lessThan": "ce839b9331c11780470f3d727b6fe3c2794a4620",
              "status": "affected",
              "version": "b8321b68d1445f308324517e45fb0a5c2b48e271",
              "versionType": "git"
            },
            {
              "lessThan": "5fd4ffa2372a41361d2bdd27ea5730e4e673240c",
              "status": "affected",
              "version": "b8321b68d1445f308324517e45fb0a5c2b48e271",
              "versionType": "git"
            },
            {
              "lessThan": "0f4d18cbea4a6e37a05fd8ee2887439f85211110",
              "status": "affected",
              "version": "b8321b68d1445f308324517e45fb0a5c2b48e271",
              "versionType": "git"
            },
            {
              "lessThan": "bf30b9ba09b0ac2a10f04dce2b0835ec4d178aa6",
              "status": "affected",
              "version": "b8321b68d1445f308324517e45fb0a5c2b48e271",
              "versionType": "git"
            },
            {
              "lessThan": "5f57843565131bb782388f9d993f9ee8f453dee1",
              "status": "affected",
              "version": "b8321b68d1445f308324517e45fb0a5c2b48e271",
              "versionType": "git"
            },
            {
              "lessThan": "d17f744e883b2f8d13cca252d71cfe8ace346f7d",
              "status": "affected",
              "version": "b8321b68d1445f308324517e45fb0a5c2b48e271",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/raid10.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.3"
            },
            {
              "lessThan": "3.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.326",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.291",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.256",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.137",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.326",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.291",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.256",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.211",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.137",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.61",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.18",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.2",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd-raid10: fix KASAN warning\n\nThere\u0027s a KASAN warning in raid10_remove_disk when running the lvm\ntest lvconvert-raid-reshape.sh. We fix this warning by verifying that the\nvalue \"number\" is valid.\n\nBUG: KASAN: slab-out-of-bounds in raid10_remove_disk+0x61/0x2a0 [raid10]\nRead of size 8 at addr ffff889108f3d300 by task mdX_raid10/124682\n\nCPU: 3 PID: 124682 Comm: mdX_raid10 Not tainted 5.19.0-rc6 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x34/0x44\n print_report.cold+0x45/0x57a\n ? __lock_text_start+0x18/0x18\n ? raid10_remove_disk+0x61/0x2a0 [raid10]\n kasan_report+0xa8/0xe0\n ? raid10_remove_disk+0x61/0x2a0 [raid10]\n raid10_remove_disk+0x61/0x2a0 [raid10]\nBuffer I/O error on dev dm-76, logical block 15344, async page read\n ? __mutex_unlock_slowpath.constprop.0+0x1e0/0x1e0\n remove_and_add_spares+0x367/0x8a0 [md_mod]\n ? super_written+0x1c0/0x1c0 [md_mod]\n ? mutex_trylock+0xac/0x120\n ? _raw_spin_lock+0x72/0xc0\n ? _raw_spin_lock_bh+0xc0/0xc0\n md_check_recovery+0x848/0x960 [md_mod]\n raid10d+0xcf/0x3360 [raid10]\n ? sched_clock_cpu+0x185/0x1a0\n ? rb_erase+0x4d4/0x620\n ? var_wake_function+0xe0/0xe0\n ? psi_group_change+0x411/0x500\n ? preempt_count_sub+0xf/0xc0\n ? _raw_spin_lock_irqsave+0x78/0xc0\n ? __lock_text_start+0x18/0x18\n ? raid10_sync_request+0x36c0/0x36c0 [raid10]\n ? preempt_count_sub+0xf/0xc0\n ? _raw_spin_unlock_irqrestore+0x19/0x40\n ? del_timer_sync+0xa9/0x100\n ? try_to_del_timer_sync+0xc0/0xc0\n ? _raw_spin_lock_irqsave+0x78/0xc0\n ? __lock_text_start+0x18/0x18\n ? _raw_spin_unlock_irq+0x11/0x24\n ? __list_del_entry_valid+0x68/0xa0\n ? finish_wait+0xa3/0x100\n md_thread+0x161/0x260 [md_mod]\n ? unregister_md_personality+0xa0/0xa0 [md_mod]\n ? _raw_spin_lock_irqsave+0x78/0xc0\n ? prepare_to_wait_event+0x2c0/0x2c0\n ? unregister_md_personality+0xa0/0xa0 [md_mod]\n kthread+0x148/0x180\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork+0x1f/0x30\n \u003c/TASK\u003e\n\nAllocated by task 124495:\n kasan_save_stack+0x1e/0x40\n __kasan_kmalloc+0x80/0xa0\n setup_conf+0x140/0x5c0 [raid10]\n raid10_run+0x4cd/0x740 [raid10]\n md_run+0x6f9/0x1300 [md_mod]\n raid_ctr+0x2531/0x4ac0 [dm_raid]\n dm_table_add_target+0x2b0/0x620 [dm_mod]\n table_load+0x1c8/0x400 [dm_mod]\n ctl_ioctl+0x29e/0x560 [dm_mod]\n dm_compat_ctl_ioctl+0x7/0x20 [dm_mod]\n __do_compat_sys_ioctl+0xfa/0x160\n do_syscall_64+0x90/0xc0\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nLast potentially related work creation:\n kasan_save_stack+0x1e/0x40\n __kasan_record_aux_stack+0x9e/0xc0\n kvfree_call_rcu+0x84/0x480\n timerfd_release+0x82/0x140\nL __fput+0xfa/0x400\n task_work_run+0x80/0xc0\n exit_to_user_mode_prepare+0x155/0x160\n syscall_exit_to_user_mode+0x12/0x40\n do_syscall_64+0x42/0xc0\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nSecond to last potentially related work creation:\n kasan_save_stack+0x1e/0x40\n __kasan_record_aux_stack+0x9e/0xc0\n kvfree_call_rcu+0x84/0x480\n timerfd_release+0x82/0x140\n __fput+0xfa/0x400\n task_work_run+0x80/0xc0\n exit_to_user_mode_prepare+0x155/0x160\n syscall_exit_to_user_mode+0x12/0x40\n do_syscall_64+0x42/0xc0\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nThe buggy address belongs to the object at ffff889108f3d200\n which belongs to the cache kmalloc-256 of size 256\nThe buggy address is located 0 bytes to the right of\n 256-byte region [ffff889108f3d200, ffff889108f3d300)\n\nThe buggy address belongs to the physical page:\npage:000000007ef2a34c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1108f3c\nhead:000000007ef2a34c order:2 compound_mapcount:0 compound_pincount:0\nflags: 0x4000000000010200(slab|head|zone=2)\nraw: 4000000000010200 0000000000000000 dead000000000001 ffff889100042b40\nraw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff889108f3d200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff889108f3d280: 00 00\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:14:56.841Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/75fbd370a2cec9e92f48285bd90735ed0c837f52"
        },
        {
          "url": "https://git.kernel.org/stable/c/bcbdc26a44aba488d2f7122f2d66801bccb74733"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a6ccc8fa192fd357c2d5d4c6ce67c834a179e23"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce839b9331c11780470f3d727b6fe3c2794a4620"
        },
        {
          "url": "https://git.kernel.org/stable/c/5fd4ffa2372a41361d2bdd27ea5730e4e673240c"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f4d18cbea4a6e37a05fd8ee2887439f85211110"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf30b9ba09b0ac2a10f04dce2b0835ec4d178aa6"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f57843565131bb782388f9d993f9ee8f453dee1"
        },
        {
          "url": "https://git.kernel.org/stable/c/d17f744e883b2f8d13cca252d71cfe8ace346f7d"
        }
      ],
      "title": "md-raid10: fix KASAN warning",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50211",
    "datePublished": "2025-06-18T11:03:49.739Z",
    "dateReserved": "2025-06-18T10:57:27.429Z",
    "dateUpdated": "2026-05-11T19:14:56.841Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50211",
      "date": "2026-09-16",
      "epss": "0.00224",
      "percentile": "0.13141"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50211\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-06-18T11:15:51.970\",\"lastModified\":\"2026-06-17T05:22:59.217\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmd-raid10: fix KASAN warning\\n\\nThere\u0027s a KASAN warning in raid10_remove_disk when running the lvm\\ntest lvconvert-raid-reshape.sh. We fix this warning by verifying that the\\nvalue \\\"number\\\" is valid.\\n\\nBUG: KASAN: slab-out-of-bounds in raid10_remove_disk+0x61/0x2a0 [raid10]\\nRead of size 8 at addr ffff889108f3d300 by task mdX_raid10/124682\\n\\nCPU: 3 PID: 124682 Comm: mdX_raid10 Not tainted 5.19.0-rc6 #1\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0x34/0x44\\n print_report.cold+0x45/0x57a\\n ? __lock_text_start+0x18/0x18\\n ? raid10_remove_disk+0x61/0x2a0 [raid10]\\n kasan_report+0xa8/0xe0\\n ? raid10_remove_disk+0x61/0x2a0 [raid10]\\n raid10_remove_disk+0x61/0x2a0 [raid10]\\nBuffer I/O error on dev dm-76, logical block 15344, async page read\\n ? __mutex_unlock_slowpath.constprop.0+0x1e0/0x1e0\\n remove_and_add_spares+0x367/0x8a0 [md_mod]\\n ? super_written+0x1c0/0x1c0 [md_mod]\\n ? mutex_trylock+0xac/0x120\\n ? _raw_spin_lock+0x72/0xc0\\n ? _raw_spin_lock_bh+0xc0/0xc0\\n md_check_recovery+0x848/0x960 [md_mod]\\n raid10d+0xcf/0x3360 [raid10]\\n ? sched_clock_cpu+0x185/0x1a0\\n ? rb_erase+0x4d4/0x620\\n ? var_wake_function+0xe0/0xe0\\n ? psi_group_change+0x411/0x500\\n ? preempt_count_sub+0xf/0xc0\\n ? _raw_spin_lock_irqsave+0x78/0xc0\\n ? __lock_text_start+0x18/0x18\\n ? raid10_sync_request+0x36c0/0x36c0 [raid10]\\n ? preempt_count_sub+0xf/0xc0\\n ? _raw_spin_unlock_irqrestore+0x19/0x40\\n ? del_timer_sync+0xa9/0x100\\n ? try_to_del_timer_sync+0xc0/0xc0\\n ? _raw_spin_lock_irqsave+0x78/0xc0\\n ? __lock_text_start+0x18/0x18\\n ? _raw_spin_unlock_irq+0x11/0x24\\n ? __list_del_entry_valid+0x68/0xa0\\n ? finish_wait+0xa3/0x100\\n md_thread+0x161/0x260 [md_mod]\\n ? unregister_md_personality+0xa0/0xa0 [md_mod]\\n ? _raw_spin_lock_irqsave+0x78/0xc0\\n ? prepare_to_wait_event+0x2c0/0x2c0\\n ? unregister_md_personality+0xa0/0xa0 [md_mod]\\n kthread+0x148/0x180\\n ? kthread_complete_and_exit+0x20/0x20\\n ret_from_fork+0x1f/0x30\\n \u003c/TASK\u003e\\n\\nAllocated by task 124495:\\n kasan_save_stack+0x1e/0x40\\n __kasan_kmalloc+0x80/0xa0\\n setup_conf+0x140/0x5c0 [raid10]\\n raid10_run+0x4cd/0x740 [raid10]\\n md_run+0x6f9/0x1300 [md_mod]\\n raid_ctr+0x2531/0x4ac0 [dm_raid]\\n dm_table_add_target+0x2b0/0x620 [dm_mod]\\n table_load+0x1c8/0x400 [dm_mod]\\n ctl_ioctl+0x29e/0x560 [dm_mod]\\n dm_compat_ctl_ioctl+0x7/0x20 [dm_mod]\\n __do_compat_sys_ioctl+0xfa/0x160\\n do_syscall_64+0x90/0xc0\\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\\n\\nLast potentially related work creation:\\n kasan_save_stack+0x1e/0x40\\n __kasan_record_aux_stack+0x9e/0xc0\\n kvfree_call_rcu+0x84/0x480\\n timerfd_release+0x82/0x140\\nL __fput+0xfa/0x400\\n task_work_run+0x80/0xc0\\n exit_to_user_mode_prepare+0x155/0x160\\n syscall_exit_to_user_mode+0x12/0x40\\n do_syscall_64+0x42/0xc0\\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\\n\\nSecond to last potentially related work creation:\\n kasan_save_stack+0x1e/0x40\\n __kasan_record_aux_stack+0x9e/0xc0\\n kvfree_call_rcu+0x84/0x480\\n timerfd_release+0x82/0x140\\n __fput+0xfa/0x400\\n task_work_run+0x80/0xc0\\n exit_to_user_mode_prepare+0x155/0x160\\n syscall_exit_to_user_mode+0x12/0x40\\n do_syscall_64+0x42/0xc0\\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\\n\\nThe buggy address belongs to the object at ffff889108f3d200\\n which belongs to the cache kmalloc-256 of size 256\\nThe buggy address is located 0 bytes to the right of\\n 256-byte region [ffff889108f3d200, ffff889108f3d300)\\n\\nThe buggy address belongs to the physical page:\\npage:000000007ef2a34c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1108f3c\\nhead:000000007ef2a34c order:2 compound_mapcount:0 compound_pincount:0\\nflags: 0x4000000000010200(slab|head|zone=2)\\nraw: 4000000000010200 0000000000000000 dead000000000001 ffff889100042b40\\nraw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000\\npage dumped because: kasan: bad access detected\\n\\nMemory state around the buggy address:\\n ffff889108f3d200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\\n ffff889108f3d280: 00 00\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: md-raid10: correcci\u00f3n de la advertencia de KASAN. Hay una advertencia de KASAN en raid10_remove_disk al ejecutar la prueba lvm lvconvert-raid-reshape.sh. Para corregir esta advertencia, verificamos que el valor \\\"number\\\" sea v\u00e1lido. ERROR: KASAN: slab fuera de los l\u00edmites en raid10_remove_disk+0x61/0x2a0 [raid10] Lectura de tama\u00f1o 8 en la direcci\u00f3n ffff889108f3d300 por la tarea mdX_raid10/124682 CPU: 3 PID: 124682 Comm: mdX_raid10 No contaminado 5.19.0-rc6 #1 Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 01/04/2014 Seguimiento de llamadas:  dump_stack_lvl+0x34/0x44 print_report.cold+0x45/0x57a ? __lock_text_start+0x18/0x18 ? raid10_remove_disk+0x61/0x2a0 [raid10] kasan_report+0xa8/0xe0 ? raid10_remove_disk+0x61/0x2a0 [raid10] raid10_remove_disk+0x61/0x2a0 [raid10] Buffer I/O error on dev dm-76, logical block 15344, async page read ? __mutex_unlock_slowpath.constprop.0+0x1e0/0x1e0 remove_and_add_spares+0x367/0x8a0 [md_mod] ? super_written+0x1c0/0x1c0 [md_mod] ? mutex_trylock+0xac/0x120 ? _raw_spin_lock+0x72/0xc0 ? _raw_spin_lock_bh+0xc0/0xc0 md_check_recovery+0x848/0x960 [md_mod] raid10d+0xcf/0x3360 [raid10] ? sched_clock_cpu+0x185/0x1a0 ? rb_erase+0x4d4/0x620 ? var_wake_function+0xe0/0xe0 ? psi_group_change+0x411/0x500 ? preempt_count_sub+0xf/0xc0 ? _raw_spin_lock_irqsave+0x78/0xc0 ? __lock_text_start+0x18/0x18 ? raid10_sync_request+0x36c0/0x36c0 [raid10] ? preempt_count_sub+0xf/0xc0 ? _raw_spin_unlock_irqrestore+0x19/0x40 ? del_timer_sync+0xa9/0x100 ? try_to_del_timer_sync+0xc0/0xc0 ? _raw_spin_lock_irqsave+0x78/0xc0 ? __lock_text_start+0x18/0x18 ? _raw_spin_unlock_irq+0x11/0x24 ? __list_del_entry_valid+0x68/0xa0 ? finish_wait+0xa3/0x100 md_thread+0x161/0x260 [md_mod] ? unregister_md_personality+0xa0/0xa0 [md_mod] ? _raw_spin_lock_irqsave+0x78/0xc0 ? prepare_to_wait_event+0x2c0/0x2c0 ? unregister_md_personality+0xa0/0xa0 [md_mod] kthread+0x148/0x180 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30  Allocated by task 124495: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x80/0xa0 setup_conf+0x140/0x5c0 [raid10] raid10_run+0x4cd/0x740 [raid10] md_run+0x6f9/0x1300 [md_mod] raid_ctr+0x2531/0x4ac0 [dm_raid] dm_table_add_target+0x2b0/0x620 [dm_mod] table_load+0x1c8/0x400 [dm_mod] ctl_ioctl+0x29e/0x560 [dm_mod] dm_compat_ctl_ioctl+0x7/0x20 [dm_mod] __do_compat_sys_ioctl+0xfa/0x160 do_syscall_64+0x90/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0x9e/0xc0 kvfree_call_rcu+0x84/0x480 timerfd_release+0x82/0x140 L __fput+0xfa/0x400 task_work_run+0x80/0xc0 exit_to_user_mode_prepare+0x155/0x160 syscall_exit_to_user_mode+0x12/0x40 do_syscall_64+0x42/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Second to last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0x9e/0xc0 kvfree_call_rcu+0x84/0x480 timerfd_release+0x82/0x140 __fput+0xfa/0x400 task_work_run+0x80/0xc0 exit_to_user_mode_prepare+0x155/0x160 syscall_exit_to_user_mode+0x12/0x40 do_syscall_64+0x42/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The buggy address belongs to the object at ffff889108f3d200 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 0 bytes to the right of 256-byte region [ffff889108f3d200, ffff889108f3d300) The buggy address belongs to the physical page: page:000000007ef2a34c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1108f3c head:000000007ef2a34c order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=2) raw: 4000000000010200 0000000000000000 dead000000000001 ffff889100042b40 raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff889108f3d200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff889108f3d280: 00 00 ---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/md/raid10.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b8321b68d1445f308324517e45fb0a5c2b48e271\",\"lessThan\":\"75fbd370a2cec9e92f48285bd90735ed0c837f52\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b8321b68d1445f308324517e45fb0a5c2b48e271\",\"lessThan\":\"bcbdc26a44aba488d2f7122f2d66801bccb74733\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b8321b68d1445f308324517e45fb0a5c2b48e271\",\"lessThan\":\"7a6ccc8fa192fd357c2d5d4c6ce67c834a179e23\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b8321b68d1445f308324517e45fb0a5c2b48e271\",\"lessThan\":\"ce839b9331c11780470f3d727b6fe3c2794a4620\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b8321b68d1445f308324517e45fb0a5c2b48e271\",\"lessThan\":\"5fd4ffa2372a41361d2bdd27ea5730e4e673240c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b8321b68d1445f308324517e45fb0a5c2b48e271\",\"lessThan\":\"0f4d18cbea4a6e37a05fd8ee2887439f85211110\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b8321b68d1445f308324517e45fb0a5c2b48e271\",\"lessThan\":\"bf30b9ba09b0ac2a10f04dce2b0835ec4d178aa6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b8321b68d1445f308324517e45fb0a5c2b48e271\",\"lessThan\":\"5f57843565131bb782388f9d993f9ee8f453dee1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b8321b68d1445f308324517e45fb0a5c2b48e271\",\"lessThan\":\"d17f744e883b2f8d13cca252d71cfe8ace346f7d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/md/raid10.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.9.326\",\"lessThanOrEqual\":\"4.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.291\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.256\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.211\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.137\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.61\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18.18\",\"lessThanOrEqual\":\"5.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19.2\",\"lessThanOrEqual\":\"5.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.9.326\",\"matchCriteriaId\":\"5B4EA906-CFF9-4D4A-AFD7-43AC02C77E48\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10\",\"versionEndExcluding\":\"4.14.291\",\"matchCriteriaId\":\"3BBC7E43-6161-4F21-977C-5BB7792C6C94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.256\",\"matchCriteriaId\":\"6C47CDE3-B039-4AE5-B8E4-1DC820E473FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.211\",\"matchCriteriaId\":\"B1C63D19-C08C-4308-A848-B2523C9275BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.137\",\"matchCriteriaId\":\"C2BF720F-C5EE-4DE2-9BDF-CE4CFBC767F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.61\",\"matchCriteriaId\":\"51861563-7F40-460F-82CD-2D3FBDAD6618\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.18.18\",\"matchCriteriaId\":\"5B42E453-8837-49D0-A5EF-03F818A6DC11\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.19\",\"versionEndExcluding\":\"5.19.2\",\"matchCriteriaId\":\"A1A2A5A5-4598-4D7E-BA07-4660398D6C8F\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0f4d18cbea4a6e37a05fd8ee2887439f85211110\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5f57843565131bb782388f9d993f9ee8f453dee1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5fd4ffa2372a41361d2bdd27ea5730e4e673240c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/75fbd370a2cec9e92f48285bd90735ed0c837f52\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7a6ccc8fa192fd357c2d5d4c6ce67c834a179e23\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bcbdc26a44aba488d2f7122f2d66801bccb74733\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bf30b9ba09b0ac2a10f04dce2b0835ec4d178aa6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ce839b9331c11780470f3d727b6fe3c2794a4620\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d17f744e883b2f8d13cca252d71cfe8ace346f7d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T21:43:26+00:00",
      "cve": "CVE-2022-50211",
      "id": "CVE-2022-50211",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "810",
      "product_status:known_affected": "52",
      "product_status:known_not_affected": "77",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: md-raid10: fix KASAN warning",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50211.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-13T23:50:15Z",
      "cve": "CVE-2022-50211",
      "id": "CVE-2022-50211",
      "initial_release_date": "2025-06-19T03:38:59Z",
      "product_status:known_affected": "446",
      "product_status:known_not_affected": "347",
      "product_status:recommended": "397",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50211",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50211.json",
      "version": "70"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.