CVE-2022-50422

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-50422
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-50422.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-50422
Downstream
Related
Published
2025-10-01T11:41:55.147Z
Modified
2026-03-12T03:26:29.046940Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()
Details

In the Linux kernel, the following vulnerability has been resolved:

scsi: libsas: Fix use-after-free bug in smpexecutetask_sg()

When executing SMP task failed, the smpexecutetasksg() calls deltimer() to delete "slowtask->timer". However, if the timer handler sastaskinternaltimedout() is running, the deltimer() in smpexecutetasksg() will not stop it and a UAF will happen. The process is shown below:

  (thread 1)               |        (thread 2)

smpexecutetasksg() | sastaskinternaltimedout() ... | deltimer() | ... | ... sasfreetask(task) | kfree(task->slowtask) //FREE| | task->slow_task->... //USE

Fix by calling deltimersync() in smpexecutetasksg(), which makes sure the timer handler have finished before the "task->slowtask" is deallocated.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50422.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
2908d778ab3e244900c310974e1fc1c69066e450
Fixed
117331a2a5227fb4369c2a1f321d3e3e2e2ef8fe
Fixed
a9e5176ead6de64f572ad5c87a72825d9d3c82ae
Fixed
e45a1516d2933703a4823d9db71e17c3abeba24f
Fixed
f7a785177611ffc97d645fcbc196e6de6ad2421d
Fixed
2e12ce270f0d926085c1209cc90397e307deef97
Fixed
46ba53c30666717cb06c2b3c5d896301cd00d0c0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-50422.json"