CVE-2022-50092 (GCVE-0-2022-50092)

Vulnerability from cvelistv5 – Published: 2025-06-18 11:02 – Updated: 2026-05-11 19:12
VLAI
Title
dm thin: fix use-after-free crash in dm_sm_register_threshold_callback
Summary
In the Linux kernel, the following vulnerability has been resolved: dm thin: fix use-after-free crash in dm_sm_register_threshold_callback Fault inject on pool metadata device reports: BUG: KASAN: use-after-free in dm_pool_register_metadata_threshold+0x40/0x80 Read of size 8 at addr ffff8881b9d50068 by task dmsetup/950 CPU: 7 PID: 950 Comm: dmsetup Tainted: G W 5.19.0-rc6 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_address_description.constprop.0.cold+0xeb/0x3f4 kasan_report.cold+0xe6/0x147 dm_pool_register_metadata_threshold+0x40/0x80 pool_ctr+0xa0a/0x1150 dm_table_add_target+0x2c8/0x640 table_load+0x1fd/0x430 ctl_ioctl+0x2c4/0x5a0 dm_ctl_ioctl+0xa/0x10 __x64_sys_ioctl+0xb3/0xd0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 This can be easily reproduced using: echo offline > /sys/block/sda/device/state dd if=/dev/zero of=/dev/mapper/thin bs=4k count=10 dmsetup load pool --table "0 20971520 thin-pool /dev/sda /dev/sdb 128 0 0" If a metadata commit fails, the transaction will be aborted and the metadata space maps will be destroyed. If a DM table reload then happens for this failed thin-pool, a use-after-free will occur in dm_sm_register_threshold_callback (called from dm_pool_register_metadata_threshold). Fix this by in dm_pool_register_metadata_threshold() by returning the -EINVAL error if the thin-pool is in fail mode. Also fail pool_ctr() with a new error message: "Error registering metadata threshold".
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ac8c3f3df65e487bbcabf274eeeb9cd222f5da1e , < 05cef0999b3208b5a6ede1bfac855139e4de55ef (git)
Affected: ac8c3f3df65e487bbcabf274eeeb9cd222f5da1e , < 5e2cf705155a1514be3c96ea664a9cd356998ee7 (git)
Affected: ac8c3f3df65e487bbcabf274eeeb9cd222f5da1e , < f83131a3071a0b61a4d7dca70f95adb3ffad920e (git)
Affected: ac8c3f3df65e487bbcabf274eeeb9cd222f5da1e , < 1a199fa9217d28511ff88529238fd9980ea64cf3 (git)
Affected: ac8c3f3df65e487bbcabf274eeeb9cd222f5da1e , < e4dbe24f4bfd8377e7ba79fdcdb7c4d6eb1c6790 (git)
Affected: ac8c3f3df65e487bbcabf274eeeb9cd222f5da1e , < 3534e5a5ed2997ca1b00f44a0378a075bd05e8a3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.10
Unaffected: 0 , < 3.10 (semver)
Unaffected: 5.4.211 , ≤ 5.4.* (semver)
Unaffected: 5.10.137 , ≤ 5.10.* (semver)
Unaffected: 5.15.61 , ≤ 5.15.* (semver)
Unaffected: 5.18.18 , ≤ 5.18.* (semver)
Unaffected: 5.19.2 , ≤ 5.19.* (semver)
Unaffected: 6.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-thin-metadata.c",
            "drivers/md/dm-thin.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "05cef0999b3208b5a6ede1bfac855139e4de55ef",
              "status": "affected",
              "version": "ac8c3f3df65e487bbcabf274eeeb9cd222f5da1e",
              "versionType": "git"
            },
            {
              "lessThan": "5e2cf705155a1514be3c96ea664a9cd356998ee7",
              "status": "affected",
              "version": "ac8c3f3df65e487bbcabf274eeeb9cd222f5da1e",
              "versionType": "git"
            },
            {
              "lessThan": "f83131a3071a0b61a4d7dca70f95adb3ffad920e",
              "status": "affected",
              "version": "ac8c3f3df65e487bbcabf274eeeb9cd222f5da1e",
              "versionType": "git"
            },
            {
              "lessThan": "1a199fa9217d28511ff88529238fd9980ea64cf3",
              "status": "affected",
              "version": "ac8c3f3df65e487bbcabf274eeeb9cd222f5da1e",
              "versionType": "git"
            },
            {
              "lessThan": "e4dbe24f4bfd8377e7ba79fdcdb7c4d6eb1c6790",
              "status": "affected",
              "version": "ac8c3f3df65e487bbcabf274eeeb9cd222f5da1e",
              "versionType": "git"
            },
            {
              "lessThan": "3534e5a5ed2997ca1b00f44a0378a075bd05e8a3",
              "status": "affected",
              "version": "ac8c3f3df65e487bbcabf274eeeb9cd222f5da1e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-thin-metadata.c",
            "drivers/md/dm-thin.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.10"
            },
            {
              "lessThan": "3.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.137",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.211",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.137",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.61",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.18",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.2",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm thin: fix use-after-free crash in dm_sm_register_threshold_callback\n\nFault inject on pool metadata device reports:\n  BUG: KASAN: use-after-free in dm_pool_register_metadata_threshold+0x40/0x80\n  Read of size 8 at addr ffff8881b9d50068 by task dmsetup/950\n\n  CPU: 7 PID: 950 Comm: dmsetup Tainted: G        W         5.19.0-rc6 #1\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x34/0x44\n   print_address_description.constprop.0.cold+0xeb/0x3f4\n   kasan_report.cold+0xe6/0x147\n   dm_pool_register_metadata_threshold+0x40/0x80\n   pool_ctr+0xa0a/0x1150\n   dm_table_add_target+0x2c8/0x640\n   table_load+0x1fd/0x430\n   ctl_ioctl+0x2c4/0x5a0\n   dm_ctl_ioctl+0xa/0x10\n   __x64_sys_ioctl+0xb3/0xd0\n   do_syscall_64+0x35/0x80\n   entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nThis can be easily reproduced using:\n  echo offline \u003e /sys/block/sda/device/state\n  dd if=/dev/zero of=/dev/mapper/thin bs=4k count=10\n  dmsetup load pool --table \"0 20971520 thin-pool /dev/sda /dev/sdb 128 0 0\"\n\nIf a metadata commit fails, the transaction will be aborted and the\nmetadata space maps will be destroyed. If a DM table reload then\nhappens for this failed thin-pool, a use-after-free will occur in\ndm_sm_register_threshold_callback (called from\ndm_pool_register_metadata_threshold).\n\nFix this by in dm_pool_register_metadata_threshold() by returning the\n-EINVAL error if the thin-pool is in fail mode. Also fail pool_ctr()\nwith a new error message: \"Error registering metadata threshold\"."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:12:40.591Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/05cef0999b3208b5a6ede1bfac855139e4de55ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e2cf705155a1514be3c96ea664a9cd356998ee7"
        },
        {
          "url": "https://git.kernel.org/stable/c/f83131a3071a0b61a4d7dca70f95adb3ffad920e"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a199fa9217d28511ff88529238fd9980ea64cf3"
        },
        {
          "url": "https://git.kernel.org/stable/c/e4dbe24f4bfd8377e7ba79fdcdb7c4d6eb1c6790"
        },
        {
          "url": "https://git.kernel.org/stable/c/3534e5a5ed2997ca1b00f44a0378a075bd05e8a3"
        }
      ],
      "title": "dm thin: fix use-after-free crash in dm_sm_register_threshold_callback",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50092",
    "datePublished": "2025-06-18T11:02:31.372Z",
    "dateReserved": "2025-06-18T10:57:27.411Z",
    "dateUpdated": "2026-05-11T19:12:40.591Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50092",
      "date": "2026-09-25",
      "epss": "0.0024",
      "percentile": "0.13511"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/md/dm-thin-metadata.c",
                  "drivers/md/dm-thin.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "05cef0999b3208b5a6ede1bfac855139e4de55ef",
                    "status": "affected",
                    "version": "ac8c3f3df65e487bbcabf274eeeb9cd222f5da1e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5e2cf705155a1514be3c96ea664a9cd356998ee7",
                    "status": "affected",
                    "version": "ac8c3f3df65e487bbcabf274eeeb9cd222f5da1e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f83131a3071a0b61a4d7dca70f95adb3ffad920e",
                    "status": "affected",
                    "version": "ac8c3f3df65e487bbcabf274eeeb9cd222f5da1e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1a199fa9217d28511ff88529238fd9980ea64cf3",
                    "status": "affected",
                    "version": "ac8c3f3df65e487bbcabf274eeeb9cd222f5da1e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e4dbe24f4bfd8377e7ba79fdcdb7c4d6eb1c6790",
                    "status": "affected",
                    "version": "ac8c3f3df65e487bbcabf274eeeb9cd222f5da1e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3534e5a5ed2997ca1b00f44a0378a075bd05e8a3",
                    "status": "affected",
                    "version": "ac8c3f3df65e487bbcabf274eeeb9cd222f5da1e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/md/dm-thin-metadata.c",
                  "drivers/md/dm-thin.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.10"
                  },
                  {
                    "lessThan": "3.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.211",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.137",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.61",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.18.*",
                    "status": "unaffected",
                    "version": "5.18.18",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.19.*",
                    "status": "unaffected",
                    "version": "5.19.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A7F6121D-9871-4870-B5CF-93C2A1147348",
                    "versionEndExcluding": "5.4.211",
                    "versionStartIncluding": "3.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C2BF720F-C5EE-4DE2-9BDF-CE4CFBC767F4",
                    "versionEndExcluding": "5.10.137",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "51861563-7F40-460F-82CD-2D3FBDAD6618",
                    "versionEndExcluding": "5.15.61",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5B42E453-8837-49D0-A5EF-03F818A6DC11",
                    "versionEndExcluding": "5.18.18",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A1A2A5A5-4598-4D7E-BA07-4660398D6C8F",
                    "versionEndExcluding": "5.19.2",
                    "versionStartIncluding": "5.19",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm thin: fix use-after-free crash in dm_sm_register_threshold_callback\n\nFault inject on pool metadata device reports:\n  BUG: KASAN: use-after-free in dm_pool_register_metadata_threshold+0x40/0x80\n  Read of size 8 at addr ffff8881b9d50068 by task dmsetup/950\n\n  CPU: 7 PID: 950 Comm: dmsetup Tainted: G        W         5.19.0-rc6 #1\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x34/0x44\n   print_address_description.constprop.0.cold+0xeb/0x3f4\n   kasan_report.cold+0xe6/0x147\n   dm_pool_register_metadata_threshold+0x40/0x80\n   pool_ctr+0xa0a/0x1150\n   dm_table_add_target+0x2c8/0x640\n   table_load+0x1fd/0x430\n   ctl_ioctl+0x2c4/0x5a0\n   dm_ctl_ioctl+0xa/0x10\n   __x64_sys_ioctl+0xb3/0xd0\n   do_syscall_64+0x35/0x80\n   entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nThis can be easily reproduced using:\n  echo offline \u003e /sys/block/sda/device/state\n  dd if=/dev/zero of=/dev/mapper/thin bs=4k count=10\n  dmsetup load pool --table \"0 20971520 thin-pool /dev/sda /dev/sdb 128 0 0\"\n\nIf a metadata commit fails, the transaction will be aborted and the\nmetadata space maps will be destroyed. If a DM table reload then\nhappens for this failed thin-pool, a use-after-free will occur in\ndm_sm_register_threshold_callback (called from\ndm_pool_register_metadata_threshold).\n\nFix this by in dm_pool_register_metadata_threshold() by returning the\n-EINVAL error if the thin-pool is in fail mode. Also fail pool_ctr()\nwith a new error message: \"Error registering metadata threshold\"."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dm thin: correcci\u00f3n del fallo de uso tras liberaci\u00f3n en dm_sm_register_threshold_callback Se informa de un fallo por inyecci\u00f3n en el dispositivo de metadatos del grupo: ERROR: KASAN: uso tras liberaci\u00f3n en dm_pool_register_metadata_threshold+0x40/0x80 Lectura de tama\u00f1o 8 en la direcci\u00f3n ffff8881b9d50068 por la tarea dmsetup/950 CPU: 7 PID: 950 Comm: dmsetup Contaminado: GW 5.19.0-rc6 #1 Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 01/04/2014 Rastreo de llamadas:  dump_stack_lvl+0x34/0x44 print_address_description.constprop.0.cold+0xeb/0x3f4 kasan_report.cold+0xe6/0x147 dm_pool_register_metadata_threshold+0x40/0x80 pool_ctr+0xa0a/0x1150 dm_table_add_target+0x2c8/0x640 table_load+0x1fd/0x430 ctl_ioctl+0x2c4/0x5a0 dm_ctl_ioctl+0xa/0x10 __x64_sys_ioctl+0xb3/0xd0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Esto se puede reproducir f\u00e1cilmente usando: echo offline \u0026gt; /sys/block/sda/device/state dd if=/dev/zero of=/dev/mapper/thin bs=4k count=10 dmsetup load pool --table \"0 20971520 thin-pool /dev/sda /dev/sdb 128 0 0\" Si falla una confirmaci\u00f3n de metadatos, la transacci\u00f3n se cancelar\u00e1 y los mapas de espacio de metadatos se destruir\u00e1n. Si se recarga la tabla DM para este thin-pool fallido, se ejecutar\u00e1 un \"use after-free\" en dm_sm_register_threshold_callback (llamado desde dm_pool_register_metadata_threshold). Solucione esto en dm_pool_register_metadata_threshold() devolviendo el error -EINVAL si el thin-pool est\u00e1 en modo de fallo. Tambi\u00e9n se produce un error en pool_ctr() con un nuevo mensaje de error: \"Error al registrar el umbral de metadatos\"."
          }
        ],
        "id": "CVE-2022-50092",
        "lastModified": "2026-06-17T05:22:44.590",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-06-18T11:15:38.383",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/05cef0999b3208b5a6ede1bfac855139e4de55ef"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1a199fa9217d28511ff88529238fd9980ea64cf3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3534e5a5ed2997ca1b00f44a0378a075bd05e8a3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5e2cf705155a1514be3c96ea664a9cd356998ee7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e4dbe24f4bfd8377e7ba79fdcdb7c4d6eb1c6790"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f83131a3071a0b61a4d7dca70f95adb3ffad920e"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T21:39:17+00:00",
      "cve": "CVE-2022-50092",
      "id": "CVE-2022-50092",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "286",
      "product_status:known_affected": "80",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: dm thin: fix use-after-free crash in dm_sm_register_threshold_callback",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50092.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.