Security readout for executives and security teams
Plain-English summary
A timing flaw in Linux’s Distributed Lock Manager can let one kernel task release a message while another still uses it. The supplied record rates it critical, but the public description demonstrates a kernel warning under a non-upstream stress test rather than confirmed compromise or production impact.
Executive priority
Treat as an urgent verification and patch-management item for DLM-enabled clustered infrastructure, not as evidence of an ongoing breach. Confirm affected assets and vendor-fixed kernels promptly. Scope-based prioritization is important because the supplied severity is critical while demonstrated impact and real-world exploitability remain incomplete.
Technical view
A race between queue_work() in _dlm_lowcomms_commit_msg() and srcu_read_unlock() can consume the final dlm_msg reference before msg->idx is safely used. The cited kernel fix adds a reference between message creation and commit, ensuring the commit-side kref_put() safely performs the final release.
Likely exposure
Potential exposure is limited to systems running the listed affected Linux versions where DLM functionality is present or used. The bundle identifies 5.14, 5.15.75, 5.19.17, 6.0.3, and 6.1 as affected, but lacks complete distribution-specific package ranges; confirm vendor backports.
Exploitation context
The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation, public weaponization, or a reliable attack path. Although the supplied CVSS is 9.8 with network reachability, the technical evidence only documents a race-induced warning reproduced using a non-upstream dlm_locktorture test.
Researcher notes
CWE-362 fits the documented reference-lifetime race. Reproduction used dlm_locktorture, explicitly described as not upstream. The bundle does not establish attacker control, required DLM state, confidentiality or integrity impact, or exploitation reliability. Version data also contains an ambiguous affected entry of “0,” so distribution advisories and commit ancestry should govern conclusions.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable cited stable fix or backport.
- Check Linux distribution advisories for corrected package versions before scheduling rollout.
- Prioritize clustered systems actively using DLM while validating actual exposure.
- If immediate updating is impossible, consult vendor guidance for supported risk-reduction options.
Validation and detection
- Inventory kernel versions on systems providing clustered or DLM-dependent services.
- Determine whether DLM modules and dependent clustered filesystems are configured or active.
- Verify the installed kernel includes the applicable fix commit or vendor backport.
- Review kernel logs for DLM lowcomms, SRCU, refcount, or related warning traces.
- Retest clustered workloads after updating and monitor for recurrence.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-362: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-50373 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H13.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
4.7MediumVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/27d3e646dd83bafd7094890462eebfce3ac31e4aCVE reference, Linux
- https://git.kernel.org/stable/c/eb97e60a9eae632ff9104a580dbc4fdc58dc23cbCVE reference, Linux
- https://git.kernel.org/stable/c/de7fdff754bb4d01e38e19964c309b6df6a79472CVE reference, Linux
- https://git.kernel.org/stable/c/30ea3257e8766027c4d8d609dcbd256ff9a76073CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.