LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50850: scsi: ipr: Fix WARNING in ipr_init()

In the Linux kernel, the following vulnerability has been resolved: scsi: ipr: Fix WARNING in ipr_init() ipr_init() will not call unregister_reboot_notifier() when pci_register_driver() fails, which causes a WARNING. Call unregister_reboot_notifier() when pci_register_driver() fails. notifier callback ipr_halt [ipr] already registered WARNING: CPU: 3 PID: 299 at kernel/notifier.c:29 notifier_chain_register+0x16d/0x230 Modules linked in: ipr(+) xhci_pci_renesas xhci_hcd ehci_hcd usbcore led_class gpu_sched drm_buddy video wmi drm_ttm_helper ttm drm_display_helper drm_kms_helper drm drm_panel_orientation_quirks agpgart cfbft CPU: 3 PID: 299 Comm: modprobe Tainted: G W 6.1.0-rc1-00190-g39508d23b672-dirty #332 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010:notifier_chain_register+0x16d/0x230 Call Trace: <TASK> __blocking_notifier_chain_register+0x73/0xb0 ipr_init+0x30/0x1000 [ipr] do_one_initcall+0xdb/0x480 do_init_module+0x1cf/0x680 load_module+0x6a50/0x70a0 __do_sys_finit_module+0x12f/0x1c0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This CVE is a Linux kernel bug in the ipr SCSI driver. If driver registration fails during initialization, cleanup is incomplete and the kernel can raise a WARNING about a reboot notifier already being registered. Public sources do not describe data theft, remote compromise, privilege escalation, or active exploitation.

Executive priority

Treat as low immediate business urgency unless ipr-based storage systems are in use or affected hosts show kernel warnings. Fold remediation into normal kernel maintenance after confirming vendor backport status.

Technical view

The issue is in ipr_init(). On pci_register_driver() failure, unregister_reboot_notifier() was not called, leaving ipr_halt registered. Linux stable commits add the missing cleanup. The provided record lists Linux kernel versions as affected and links multiple stable backports. No CVSS, CWE, or KEV evidence is provided.

Likely exposure

Exposure is likely limited to Linux systems with the ipr SCSI driver available or used. Business impact appears operational rather than clearly security-critical based on the provided description. Confirm exposure against your kernel version, distribution backports, and whether the ipr driver is present.

Exploitation context

No source provided indicates active exploitation. The described trigger occurs during driver initialization failure, shown in a modprobe call trace. The sources do not identify a remote attack path, exploit prerequisites, or a confidentiality/integrity impact.

Researcher notes

The public record is sparse: no CVSS, CWE, exploit status, or detailed security impact. Analysis should focus on patch provenance, affected kernel lineage, distro backports, and whether the ipr module can be reached in relevant deployments.

Mitigation direction

  • Update to a Linux kernel or distro package containing the referenced stable fixes.
  • Check your Linux distribution advisory or changelog for this CVE or fix title.
  • Prioritize systems using ipr-supported storage hardware or loading the ipr driver.
  • If uncertain, request vendor guidance for affected kernel builds and backport status.

Validation and detection

  • Inventory Linux kernel versions across servers and appliances.
  • Check whether the ipr driver is present, enabled, or loaded.
  • Review distro kernel changelogs for the referenced ipr_init cleanup fix.
  • Confirm scanners map distribution backports, not only upstream version numbers.
  • Review kernel logs for related ipr notifier WARNING messages.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50850 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
10Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxf72919ec2bbbe1c42cdda7857a96c0c40e1d78aa, f72919ec2bbbe1c42cdda7857a96c0c40e1d78aa, f72919ec2bbbe1c42cdda7857a96c0c40e1d78aa, f72919ec2bbbe1c42cdda7857a96c0c40e1d78aa, f72919ec2bbbe1c42cdda7857a96c0c40e1d78aa, f72919ec2bbbe1c42cdda7857a96c0c40e1d78aa, f72919ec2bbbe1c42cdda7857a96c0c40e1d78aa, f72919ec2bbbe1c42cdda7857a96c0c40e1d78aa, f72919ec2bbbe1c42cdda7857a96c0c40e1d78aaunaffected
LinuxLinux2.6.34, 0, 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, 6.2affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.