Security readout for executives and security teams
Plain-English summary
A flaw in the Linux kernel's SAS storage driver could let a local user crash the system or potentially gain higher privileges by triggering a race condition between a timer and a cleanup routine. It only affects systems running unpatched Linux kernels with SAS hardware in use, and exploitation requires existing local access. Stable kernel updates are available from kernel.org.
Executive priority
Schedule kernel patching on Linux hosts with SAS storage in the next standard maintenance window. There is no evidence of active exploitation, but the high CVSS and local privilege-escalation potential warrant timely remediation, especially on multi-tenant or shared-administration systems.
Technical view
A use-after-free in libsas's smp_execute_task_sg() arises because del_timer() does not wait for an in-flight sas_task_internal_timedout() handler. The timer can dereference task->slow_task after sas_free_task() releases it. The fix replaces del_timer() with del_timer_sync() to ensure the handler completes before deallocation. CWE-416. CVSS 3.1 base 7.8 (AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H).
Likely exposure
Linux servers and appliances using libsas/SAS storage controllers on kernels prior to 5.4.220, 5.10.150, 5.15.75, 5.19.17, 6.0.3, and 6.1. Embedded storage arrays, hypervisors, and bare-metal hosts with SAS HBAs are most likely impacted. Cloud workloads on virtualized disks without SAS pass-through are typically not exposed.
Exploitation context
No public exploitation or KEV listing is cited. The CVSS vector requires local, low-privilege access without user interaction; impact is high across CIA. Race-condition timing on SMP task failure paths reduces opportunistic reliability.
Researcher notes
Root cause is asynchronous timer cancellation: del_timer() returns without synchronizing against a running handler, so kfree(task->slow_task) can race with sas_task_internal_timedout(). Fix substitutes del_timer_sync(). Reproducing requires inducing SMP task failure on a libsas-backed device. Backports landed across multiple stable trees; verify the specific commit hash present in your build matches one of the six referenced kernel.org commits.
Mitigation direction
- Upgrade Linux kernel to 5.4.220, 5.10.150, 5.15.75, 5.19.17, 6.0.3, 6.1, or later stable releases.
- Apply distribution kernel updates from your Linux vendor that include the libsas del_timer_sync() fix.
- Restrict local shell access on hosts with SAS controllers to trusted administrators only.
- Reboot systems after kernel update so the patched kernel is in active use.
- For appliances, consult the hardware vendor for firmware or kernel rollups carrying this fix.
Validation and detection
- Run uname -r and confirm the kernel meets or exceeds the fixed stable versions listed by kernel.org.
- Check distribution security advisories for CVE-2022-50422 and confirm the package version matches the patched build.
- Inventory hosts using SAS HBAs (lspci, lsscsi) to scope which systems require priority patching.
- Compare deployed kernel commit to the upstream fix commits referenced in git.kernel.org links.
- After patch, verify no regression in SAS storage health via dmesg and vendor diagnostics.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-50422 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/117331a2a5227fb4369c2a1f321d3e3e2e2ef8feCVE reference
- https://git.kernel.org/stable/c/a9e5176ead6de64f572ad5c87a72825d9d3c82aeCVE reference
- https://git.kernel.org/stable/c/e45a1516d2933703a4823d9db71e17c3abeba24fCVE reference
- https://git.kernel.org/stable/c/f7a785177611ffc97d645fcbc196e6de6ad2421dCVE reference
- https://git.kernel.org/stable/c/2e12ce270f0d926085c1209cc90397e307deef97CVE reference
- https://git.kernel.org/stable/c/46ba53c30666717cb06c2b3c5d896301cd00d0c0CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.