Security readout for executives and security teams
Plain-English summary
CVE-2022-50840 is a Linux kernel bug in the SCSI snic driver. If device creation fails, the kernel can leave a freed object on an internal list, creating a use-after-free risk during later list traversal. Public sources do not provide a CVSS score or evidence of active exploitation.
Executive priority
Treat as a targeted kernel maintenance issue, not an internet-wide emergency. Prioritize systems using the snic SCSI driver or specialized storage configurations. Fold remediation into normal kernel patch cycles unless vendor guidance raises severity.
Technical view
The flaw is in snic_tgt_create() under drivers/scsi/snic/snic_disc.c. On device_add() failure, tgt is freed without removing tgt->list from snic->disc.tgt_list. Later traversal may dereference freed memory. Kernel stable commits remove the list entry before freeing the object.
Likely exposure
Exposure appears limited to Linux systems running an affected kernel where the snic SCSI driver is built, loaded, or usable. The source bundle lists multiple Linux kernel versions as affected, but does not provide distribution-specific package mappings.
Exploitation context
No KEV listing is present, and the provided sources do not claim active exploitation. The vulnerable path requires a device_add() failure during snic target creation. Practical exploitability, privilege requirements, and impact beyond possible kernel memory safety issues are not established in the sources.
Researcher notes
The public record is sparse: no CVSS, CWE, exploit status, or distro-specific advisories are included. Analysis should focus on the error path in snic_tgt_create(), stable backports, and whether local configurations can reach the vulnerable driver path.
Mitigation direction
- Update to a Linux kernel or vendor package containing the referenced stable fixes.
- Check distribution advisories for backported fixes and package-specific version guidance.
- If snic is not needed, review whether it can be disabled per vendor guidance.
Validation and detection
- Inventory Linux kernel versions against vendor advisories and the referenced stable commits.
- Confirm whether the snic driver is present, enabled, or loaded on relevant systems.
- Verify patched kernels include the fix removing tgt->list before free().
- Review system logs for snic-related kernel faults after storage discovery events.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50840 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f9d8b8ba0f1a16cde0b1fc9e80466df76b6db8ffCVE reference
- https://git.kernel.org/stable/c/3772319e40527e6a5f2ec1d729e01f271d818f5cCVE reference
- https://git.kernel.org/stable/c/3007f96ca20c848d0b1b052df6d2cb5ae5586e78CVE reference
- https://git.kernel.org/stable/c/6866154c23fba40888ad6d554cccd4bf2edb755eCVE reference
- https://git.kernel.org/stable/c/ad27f74e901fc48729733c88818e6b96c813057dCVE reference
- https://git.kernel.org/stable/c/1895e908b3ae66a5312fd1b2cdda2da82993dca7CVE reference
- https://git.kernel.org/stable/c/c7f0f8dab1ae5def57c1a8a9cafd6fabe1dc27ccCVE reference
- https://git.kernel.org/stable/c/4141cd9e8b3379aea52a85d2c35f6eaf26d14e86CVE reference
- https://git.kernel.org/stable/c/e118df492320176af94deec000ae034cc92be754CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.