LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50092: dm thin: fix use-after-free crash in dm_sm_register_threshold_callback

In the Linux kernel, the following vulnerability has been resolved: dm thin: fix use-after-free crash in dm_sm_register_threshold_callback Fault inject on pool metadata device reports: BUG: KASAN: use-after-free in dm_pool_register_metadata_threshold+0x40/0x80 Read of size 8 at addr ffff8881b9d50068 by task dmsetup/950 CPU: 7 PID: 950 Comm: dmsetup Tainted: G W 5.19.0-rc6 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_address_description.constprop.0.cold+0xeb/0x3f4 kasan_report.cold+0xe6/0x147 dm_pool_register_metadata_threshold+0x40/0x80 pool_ctr+0xa0a/0x1150 dm_table_add_target+0x2c8/0x640 table_load+0x1fd/0x430 ctl_ioctl+0x2c4/0x5a0 dm_ctl_ioctl+0xa/0x10 __x64_sys_ioctl+0xb3/0xd0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 This can be easily reproduced using: echo offline > /sys/block/sda/device/state dd if=/dev/zero of=/dev/mapper/thin bs=4k count=10 dmsetup load pool --table "0 20971520 thin-pool /dev/sda /dev/sdb 128 0 0" If a metadata commit fails, the transaction will be aborted and the metadata space maps will be destroyed. If a DM table reload then happens for this failed thin-pool, a use-after-free will occur in dm_sm_register_threshold_callback (called from dm_pool_register_metadata_threshold). Fix this by in dm_pool_register_metadata_threshold() by returning the -EINVAL error if the thin-pool is in fail mode. Also fail pool_ctr() with a new error message: "Error registering metadata threshold".

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-50092 is a Linux kernel flaw in device-mapper thin provisioning. Under a failed thin-pool metadata state, reloading a device-mapper table can trigger a use-after-free and kernel crash. Business impact is mainly host instability for systems using thin-provisioned storage, not proven remote compromise.

Executive priority

Treat as a targeted Linux storage stability risk. Patch affected storage hosts during the next planned maintenance window, sooner for production systems relying on thin provisioning or showing metadata errors.

Technical view

The flaw is in dm thin handling around dm_sm_register_threshold_callback, called through dm_pool_register_metadata_threshold. If a metadata commit fails, metadata space maps are destroyed; a later table reload for the failed thin-pool can access freed memory. The documented fix returns EINVAL when the thin-pool is in fail mode.

Likely exposure

Exposure is most likely on Linux systems using device-mapper thin pools. The source lists Linux kernel entries including 3.10, 5.4.211, 5.10.137, 5.15.61, 5.18.18, 5.19.2, and 6.0 as affected, but provides no CPEs or distro mapping.

Exploitation context

The bundle does not show KEV listing or active exploitation. The reported trigger involved fault injection and thin-pool metadata failure followed by table reload. Evidence supports a reliability and local kernel memory-safety concern, with incomplete public detail on attacker prerequisites.

Researcher notes

Public data lacks CVSS, CWE, CPEs, and distro-specific fixed versions. The root condition is a failed thin-pool metadata state followed by threshold callback registration. Do not assume remote reachability or active exploitation from the provided sources.

Mitigation direction

  • Update to a vendor kernel containing the referenced upstream stable fixes.
  • Prioritize hosts using device-mapper thin provisioning for storage pools.
  • Review vendor advisories for exact fixed package versions.
  • Monitor thin-pool metadata failures and kernel crash reports.
  • Avoid risky storage maintenance on failed thin pools until patched.

Validation and detection

  • Inventory systems using Linux device-mapper thin pools.
  • Compare running kernel versions against vendor fixed-kernel guidance.
  • Check change logs for the referenced dm thin fix commits.
  • Review logs for thin-pool metadata failures or KASAN use-after-free reports.
  • Confirm no unsupported or end-of-life kernels remain exposed.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50092 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxac8c3f3df65e487bbcabf274eeeb9cd222f5da1e, ac8c3f3df65e487bbcabf274eeeb9cd222f5da1e, ac8c3f3df65e487bbcabf274eeeb9cd222f5da1e, ac8c3f3df65e487bbcabf274eeeb9cd222f5da1e, ac8c3f3df65e487bbcabf274eeeb9cd222f5da1e, ac8c3f3df65e487bbcabf274eeeb9cd222f5da1eunaffected
LinuxLinux3.10, 0, 5.4.211, 5.10.137, 5.15.61, 5.18.18, 5.19.2, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.