LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50697: mrp: introduce active flags to prevent UAF when applicant uninit

In the Linux kernel, the following vulnerability has been resolved: mrp: introduce active flags to prevent UAF when applicant uninit The caller of del_timer_sync must prevent restarting of the timer, If we have no this synchronization, there is a small probability that the cancellation will not be successful. And syzbot report the fellowing crash: ================================================================== BUG: KASAN: use-after-free in hlist_add_head include/linux/list.h:929 [inline] BUG: KASAN: use-after-free in enqueue_timer+0x18/0xa4 kernel/time/timer.c:605 Write at addr f9ff000024df6058 by task syz-fuzzer/2256 Pointer tag: [f9], memory tag: [fe] CPU: 1 PID: 2256 Comm: syz-fuzzer Not tainted 6.1.0-rc5-syzkaller-00008- ge01d50cbd6ee #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace.part.0+0xe0/0xf0 arch/arm64/kernel/stacktrace.c:156 dump_backtrace arch/arm64/kernel/stacktrace.c:162 [inline] show_stack+0x18/0x40 arch/arm64/kernel/stacktrace.c:163 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x68/0x84 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x1a8/0x4a0 mm/kasan/report.c:395 kasan_report+0x94/0xb4 mm/kasan/report.c:495 __do_kernel_fault+0x164/0x1e0 arch/arm64/mm/fault.c:320 do_bad_area arch/arm64/mm/fault.c:473 [inline] do_tag_check_fault+0x78/0x8c arch/arm64/mm/fault.c:749 do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:825 el1_abort+0x40/0x60 arch/arm64/kernel/entry-common.c:367 el1h_64_sync_handler+0xd8/0xe4 arch/arm64/kernel/entry-common.c:427 el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:576 hlist_add_head include/linux/list.h:929 [inline] enqueue_timer+0x18/0xa4 kernel/time/timer.c:605 mod_timer+0x14/0x20 kernel/time/timer.c:1161 mrp_periodic_timer_arm net/802/mrp.c:614 [inline] mrp_periodic_timer+0xa0/0xc0 net/802/mrp.c:627 call_timer_fn.constprop.0+0x24/0x80 kernel/time/timer.c:1474 expire_timers+0x98/0xc4 kernel/time/timer.c:1519 To fix it, we can introduce a new active flags to make sure the timer will not restart.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-50697 is a Linux kernel flaw in MRP timer cleanup. A race can restart a timer after related memory is freed, causing a use-after-free. The public record shows a syzbot crash and upstream stable fixes, but no CVSS score or known exploitation.

Executive priority

Treat as a routine but important kernel maintenance item. Prioritize internet-facing, network-critical, and embedded Linux assets if they run affected kernels. There is no cited evidence of active exploitation, but kernel memory-safety bugs can affect system availability.

Technical view

In net/802/mrp.c, applicant uninitialization can race with timer rearming. del_timer_sync alone does not prevent a callback from restarting the timer. The fix introduces active flags so MRP timers are not rearmed after shutdown, preventing KASAN-reported use-after-free in enqueue_timer/mod_timer.

Likely exposure

Exposure appears limited to Linux systems with affected kernel versions and relevant MRP networking code present or used. The source bundle lists Linux kernel versions and stable commit references, but version-range details are incomplete in the provided data.

Exploitation context

No active exploitation is reported in the provided sources, and CISA KEV status is false. The issue was demonstrated by syzbot as a kernel crash condition. Public sources do not establish remote exploitability, privilege requirements, or practical weaponization.

Researcher notes

The record lacks CVSS, CWE, and clear exploitability details. Analysis should focus on mapping downstream kernel packages to the stable commits and confirming whether net/802/mrp.c code paths are reachable in the environment. Avoid assuming impact beyond the documented use-after-free crash.

Mitigation direction

  • Update to a vendor-supported Linux kernel containing the referenced stable fixes.
  • Check your distribution advisory for the exact fixed package version.
  • Prioritize systems using MRP or related 802 networking functionality.
  • If no vendor advisory exists, track upstream stable kernel guidance.

Validation and detection

  • Inventory Linux kernel versions across servers, appliances, and embedded systems.
  • Compare installed kernels against distribution advisories and referenced upstream commits.
  • Review kernel changelogs for the MRP active-flag timer fix.
  • Confirm whether MRP functionality is enabled or operationally required.
  • Monitor vendor security notices for corrected affected-version data.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50697 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
10Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxfebf018d22347b5df94066bca05d0c11a84e839d, febf018d22347b5df94066bca05d0c11a84e839d, febf018d22347b5df94066bca05d0c11a84e839d, febf018d22347b5df94066bca05d0c11a84e839d, febf018d22347b5df94066bca05d0c11a84e839d, febf018d22347b5df94066bca05d0c11a84e839d, febf018d22347b5df94066bca05d0c11a84e839d, febf018d22347b5df94066bca05d0c11a84e839d, febf018d22347b5df94066bca05d0c11a84e839dunaffected
LinuxLinux3.9, 0, 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, 6.2affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.