LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault

In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: fix UAF in hugetlb_handle_userfault The vma_lock and hugetlb_fault_mutex are dropped before handling userfault and reacquire them again after handle_userfault(), but reacquire the vma_lock could lead to UAF[1,2] due to the following race, hugetlb_fault hugetlb_no_page /*unlock vma_lock */ hugetlb_handle_userfault handle_userfault /* unlock mm->mmap_lock*/ vm_mmap_pgoff do_mmap mmap_region munmap_vma_range /* clean old vma */ /* lock vma_lock again <--- UAF */ /* unlock vma_lock */ Since the vma_lock will unlock immediately after hugetlb_handle_userfault(), let's drop the unneeded lock and unlock in hugetlb_handle_userfault() to fix the issue. [1] https://lore.kernel.org/linux-mm/000000000000d5e00a05e834962e@google.com/ [2] https://lore.kernel.org/linux-mm/20220921014457.1668-1-liuzixian4@huawei.com/

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-50630 is a Linux kernel use-after-free bug in huge page userfault handling. It is a memory-safety issue in a privileged system component, but the public record provides no CVSS score, no confirmed exploitation, and limited affected-version clarity. Treat it as kernel maintenance priority, especially on systems using huge pages or userfaultfd-related workloads.

Executive priority

Schedule remediation through normal kernel patch cycles, with higher priority for critical Linux hosts using huge pages or memory-intensive workloads. There is no public evidence of active exploitation in the provided sources, but kernel memory-safety bugs can become serious if exploitability is later demonstrated.

Technical view

The flaw is in hugetlb_handle_userfault. Locks are dropped around handle_userfault(), and a concurrent mmap/munmap path can free the VMA before vma_lock is reacquired, creating a use-after-free. The kernel fix removes an unnecessary relock/unlock sequence. Stable kernel commit references are provided, but the CVE metadata is sparse.

Likely exposure

Linux systems running affected kernel versions with hugetlb and userfault paths may be exposed. Exposure is more plausible on hosts using huge pages, virtualization, databases, memory-intensive workloads, or userfaultfd features. The supplied version data is ambiguous, so confirm against distribution kernel advisories and patch backports.

Exploitation context

No cited source states active exploitation, and CISA KEV is false in the bundle. The issue requires a specific race condition in kernel memory-management paths. Public sources identify the bug and fixes, but do not provide a CVSS score, exploit maturity, or real-world attack reports.

Researcher notes

Key evidence is the upstream Linux commit description showing a race-created UAF involving hugetlb_fault, handle_userfault, mmap, and munmap cleanup. The CVE record lacks CVSS, CWE, and precise downstream package impact. Avoid assuming exploitability beyond the documented race and affected kernel code path.

Mitigation direction

  • Check Linux distribution advisories for CVE-2022-50630 coverage and backported fixes.
  • Upgrade to a vendor-supported kernel containing the referenced stable fixes.
  • Prioritize systems using huge pages, userfaultfd, virtualization, or memory-heavy workloads.
  • If patch status is unclear, request confirmation from the OS or appliance vendor.

Validation and detection

  • Inventory Linux kernel versions across servers, containers hosts, and appliances.
  • Compare installed kernels with vendor advisories and the referenced stable commits.
  • Confirm whether huge pages or userfaultfd-dependent services are in use.
  • Verify patched systems are running the updated kernel after reboot.
  • Document exceptions where vendor guidance is unavailable or inconclusive.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50630 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1a1aad8a9b7bd34f60cdf98cd7915f00ae892c45, 1a1aad8a9b7bd34f60cdf98cd7915f00ae892c45, 1a1aad8a9b7bd34f60cdf98cd7915f00ae892c45, 1a1aad8a9b7bd34f60cdf98cd7915f00ae892c45, 1a1aad8a9b7bd34f60cdf98cd7915f00ae892c45unaffected
LinuxLinux4.11, 0, 5.10.150, 5.15.75, 5.19.17, 6.0.3, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.