Security readout for executives and security teams
Plain-English summary
CVE-2022-50381 is a Linux kernel reliability flaw in the md RAID subsystem. A race condition can free storage I/O memory after its backing pool has been destroyed, causing a kernel crash. The business impact is availability: affected systems may panic or become unavailable under the relevant storage conditions.
Executive priority
Treat this as a planned availability fix, not an emergency remote-compromise issue. Patch during the next appropriate kernel maintenance cycle, sooner for systems where local users or storage workloads could trigger downtime.
Technical view
The bug is a race in md superblock and flush completion paths. super_written and md_end_flush could decrement in-progress counters and wake waiters before bio_put completed, allowing bioset_exit to run first. bio_put then freed a bio into a destroyed bioset, leading to a NULL pointer dereference in mempool_free.
Likely exposure
Exposure is most relevant to Linux systems using md RAID, LVM RAID, or related device-mapper storage paths on affected kernel versions. The source lists Linux kernel versions from 2.6.13 through fixed stable releases as affected context, with unaffected status after the referenced stable commits.
Exploitation context
The sources describe a crash reproduced during an LVM RAID test. They do not state active exploitation, public exploit availability, or remote attackability. CVSS marks attack vector as local, low privilege, no user interaction, and high availability impact only.
Researcher notes
Evidence supports a kernel NULL pointer dereference caused by completion-ordering in md bio lifecycle handling. The fix reorders bio_put and rdev_dec_pending before pending_writes decrement and wake-up paths. No source in the bundle confirms exploit activity beyond test-triggered crash behavior.
Mitigation direction
- Identify Linux hosts using md RAID, LVM RAID, or related device-mapper storage.
- Update to a vendor kernel containing the referenced Linux stable fixes.
- Prioritize storage-heavy or availability-critical systems first.
- Check distribution advisories before assuming upstream version mapping applies.
- Plan maintenance because kernel remediation usually requires reboot or live-patching support.
Validation and detection
- Inventory running kernel versions against the affected and fixed ranges in vendor guidance.
- Confirm whether md_mod, dm_raid, or LVM RAID storage is in use.
- Verify the installed kernel includes the relevant stable fix commit for its branch.
- Review crash logs for mempool_free, bio_put, md_end_flush, or md superblock traces.
- Run storage regression testing after patching on representative RAID/LVM configurations.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 732cd66ec19a
- Linux stable commit cf06b162f5b6
- Linux stable commit b5be563b4356
- Linux stable commit 384ef33d37ce
- Linux stable commit ae7793027766
- Linux stable commit 91bd504128a5
- Linux stable commit 842f222fc42a
- Linux stable commit 97ce99984be1
- Linux stable commit 341097ee5357
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-50381 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/732cd66ec19a17f2b9183d7d5b7bdb9c39b0776eCVE reference
- https://git.kernel.org/stable/c/cf06b162f5b6337b688072a1a47941280b8f7110CVE reference
- https://git.kernel.org/stable/c/b5be563b4356b3089b3245d024cae3f248ba7090CVE reference
- https://git.kernel.org/stable/c/384ef33d37cefb2ac539d44597d03f06c9b8975cCVE reference
- https://git.kernel.org/stable/c/ae7793027766491c5f8635b12d15a5940d3b8698CVE reference
- https://git.kernel.org/stable/c/91bd504128a51776472445070e11a3b0f9348c90CVE reference
- https://git.kernel.org/stable/c/842f222fc42a9239831e15b1fd49a51c546902cbCVE reference
- https://git.kernel.org/stable/c/97ce99984be12b9acb49ddce0f5d8ebb037adbb6CVE reference
- https://git.kernel.org/stable/c/341097ee53573e06ab9fc675d96a052385b851faCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.