{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-50219", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-06-18T10:57:27.430Z", "datePublished": "2025-06-18T11:03:54.711Z", "dateUpdated": "2026-08-05T08:57:45.064Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:57:45.064Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix KASAN use-after-free Read in compute_effective_progs\n\nSyzbot found a Use After Free bug in compute_effective_progs().\nThe reproducer creates a number of BPF links, and causes a fault\ninjected alloc to fail, while calling bpf_link_detach on them.\nLink detach triggers the link to be freed by bpf_link_free(),\nwhich calls __cgroup_bpf_detach() and update_effective_progs().\nIf the memory allocation in this function fails, the function restores\nthe pointer to the bpf_cgroup_link on the cgroup list, but the memory\ngets freed just after it returns. After this, every subsequent call to\nupdate_effective_progs() causes this already deallocated pointer to be\ndereferenced in prog_list_length(), and triggers KASAN UAF error.\n\nTo fix this issue don't preserve the pointer to the prog or link in the\nlist, but remove it and replace it with a dummy prog without shrinking\nthe table. The subsequent call to __cgroup_bpf_detach() or\n__cgroup_bpf_detach() will correct it." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is reached only via the bpf(2) syscall path for cgroup BPF link attach/detach (BPF_LINK_CREATE / BPF_LINK_DETACH or closing the link FD), which requires local process execution and is not reachable from the network stack.\nAC:L - The attacker fully controls link creation and detach timing, and can induce the required GFP_KERNEL allocation failure in compute_effective_progs() through memory pressure and large cgroup/program hierarchies; once the dangling pointer is planted, subsequent effective-prog updates reliably hit the UAF.\nPR:L - Triggering requires attaching a cgroup BPF link (CAP_NET_ADMIN via capable(), and CAP_BPF for most cgroup prog types other than CGROUP_SKB which can be loaded unprivileged), which is commonly available to container/admin-adjacent local users and is scored as Low rather than full root, consistent with similar cgroup BPF CVEs.\nUI:N - The attacker triggers the vulnerability entirely through their own bpf(2) and FD close operations; no separate victim action is required.\nS:U - Exploitation affects the host kernel's own memory and privilege boundaries (local privilege escalation within the same kernel), with no VM/IOMMU/sandbox authority boundary crossed.\nC:H - This is a use-after-free read of a freed bpf_cgroup_link (pl->link->link.prog); after heap reuse the attacker can obtain arbitrary kernel reads and install attacker-controlled pointers into the effective prog array.\nI:H - UAF of the link object enables heap spraying so a forged bpf_cgroup_link/prog pointer is written into cgroup effective program arrays, yielding arbitrary kernel write/control-flow hijack when those hooks run.\nA:H - The dangling link pointer is dereferenced on later update_effective_progs()/compute_effective_progs() calls and causes kernel oops/KASAN use-after-free crashes, so availability impact is High." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/bpf/cgroup.c" ], "versions": [ { "version": "af6eea57437a830293eab56246b6025cc7d46ee7", "lessThan": "3527e3cbb84d8868c4d4e91ba55915f96d39ec3d", "status": "affected", "versionType": "git" }, { "version": "af6eea57437a830293eab56246b6025cc7d46ee7", "lessThan": "1f8ca9c40e6222ce431e9ba5dae3cccce8ef9443", "status": "affected", "versionType": "git" }, { "version": "af6eea57437a830293eab56246b6025cc7d46ee7", "lessThan": "6336388715afa419cc97d0255bda3bba1b96b7ca", "status": "affected", "versionType": "git" }, { "version": "af6eea57437a830293eab56246b6025cc7d46ee7", "lessThan": "be001f9da71eaa3b61e186fb88bde3279728bdca", "status": "affected", "versionType": "git" }, { "version": "af6eea57437a830293eab56246b6025cc7d46ee7", "lessThan": "4c46091ee985ae84c60c5e95055d779fcd291d87", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/bpf/cgroup.c" ], "versions": [ { "version": "5.7", "status": "affected" }, { "version": "0", "lessThan": "5.7", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.138", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.61", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.18.18", "lessThanOrEqual": "5.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.19.2", "lessThanOrEqual": "5.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.10.138" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.15.61" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.18.18" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.19.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/3527e3cbb84d8868c4d4e91ba55915f96d39ec3d" }, { "url": "https://git.kernel.org/stable/c/1f8ca9c40e6222ce431e9ba5dae3cccce8ef9443" }, { "url": "https://git.kernel.org/stable/c/6336388715afa419cc97d0255bda3bba1b96b7ca" }, { "url": "https://git.kernel.org/stable/c/be001f9da71eaa3b61e186fb88bde3279728bdca" }, { "url": "https://git.kernel.org/stable/c/4c46091ee985ae84c60c5e95055d779fcd291d87" } ], "title": "bpf: Fix KASAN use-after-free Read in compute_effective_progs", "x_generator": { "engine": "bippy-1.2.0" } } } }