CVE-2022-50315 (GCVE-0-2022-50315)

Vulnerability from cvelistv5 – Published: 2025-09-15 14:46 – Updated: 2026-08-05 08:58
VLAI
Title
ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS
Summary
In the Linux kernel, the following vulnerability has been resolved: ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS UBSAN complains about array-index-out-of-bounds: [ 1.980703] kernel: UBSAN: array-index-out-of-bounds in /build/linux-9H675w/linux-5.15.0/drivers/ata/libahci.c:968:41 [ 1.980709] kernel: index 15 is out of range for type 'ahci_em_priv [8]' [ 1.980713] kernel: CPU: 0 PID: 209 Comm: scsi_eh_8 Not tainted 5.15.0-25-generic #25-Ubuntu [ 1.980716] kernel: Hardware name: System manufacturer System Product Name/P5Q3, BIOS 1102 06/11/2010 [ 1.980718] kernel: Call Trace: [ 1.980721] kernel: <TASK> [ 1.980723] kernel: show_stack+0x52/0x58 [ 1.980729] kernel: dump_stack_lvl+0x4a/0x5f [ 1.980734] kernel: dump_stack+0x10/0x12 [ 1.980736] kernel: ubsan_epilogue+0x9/0x45 [ 1.980739] kernel: __ubsan_handle_out_of_bounds.cold+0x44/0x49 [ 1.980742] kernel: ahci_qc_issue+0x166/0x170 [libahci] [ 1.980748] kernel: ata_qc_issue+0x135/0x240 [ 1.980752] kernel: ata_exec_internal_sg+0x2c4/0x580 [ 1.980754] kernel: ? vprintk_default+0x1d/0x20 [ 1.980759] kernel: ata_exec_internal+0x67/0xa0 [ 1.980762] kernel: sata_pmp_read+0x8d/0xc0 [ 1.980765] kernel: sata_pmp_read_gscr+0x3c/0x90 [ 1.980768] kernel: sata_pmp_attach+0x8b/0x310 [ 1.980771] kernel: ata_eh_revalidate_and_attach+0x28c/0x4b0 [ 1.980775] kernel: ata_eh_recover+0x6b6/0xb30 [ 1.980778] kernel: ? ahci_do_hardreset+0x180/0x180 [libahci] [ 1.980783] kernel: ? ahci_stop_engine+0xb0/0xb0 [libahci] [ 1.980787] kernel: ? ahci_do_softreset+0x290/0x290 [libahci] [ 1.980792] kernel: ? trace_event_raw_event_ata_eh_link_autopsy_qc+0xe0/0xe0 [ 1.980795] kernel: sata_pmp_eh_recover.isra.0+0x214/0x560 [ 1.980799] kernel: sata_pmp_error_handler+0x23/0x40 [ 1.980802] kernel: ahci_error_handler+0x43/0x80 [libahci] [ 1.980806] kernel: ata_scsi_port_error_handler+0x2b1/0x600 [ 1.980810] kernel: ata_scsi_error+0x9c/0xd0 [ 1.980813] kernel: scsi_error_handler+0xa1/0x180 [ 1.980817] kernel: ? scsi_unjam_host+0x1c0/0x1c0 [ 1.980820] kernel: kthread+0x12a/0x150 [ 1.980823] kernel: ? set_kthread_struct+0x50/0x50 [ 1.980826] kernel: ret_from_fork+0x22/0x30 [ 1.980831] kernel: </TASK> This happens because sata_pmp_init_links() initialize link->pmp up to SATA_PMP_MAX_PORTS while em_priv is declared as 8 elements array. I can't find the maximum Enclosure Management ports specified in AHCI spec v1.3.1, but "12.2.1 LED message type" states that "Port Multiplier Information" can utilize 4 bits, which implies it can support up to 16 ports. Hence, use SATA_PMP_MAX_PORTS as EM_MAX_SLOTS to resolve the issue. BugLink: https://bugs.launchpad.net/bugs/1970074
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee , < f70bd4339cb68bc7e206af4c922bc0d249244403 (git)
Affected: 18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee , < da2ea4a961d9f89ed248734e7032350c260dc3a3 (git)
Affected: 18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee , < 67a00c299c5c143817c948fbc7de1a2fa1af38fb (git)
Affected: 18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee , < 383b7c50f5445ff8dbbf03080905648d6980c39d (git)
Affected: 18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee , < 303d0f761431d848dd8d7ff9fd9b8c101879cabe (git)
Affected: 18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee , < 8fbe13de1cc7cef2564be3cbf60400b33eee023b (git)
Affected: 18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee , < d6314d5f68764550c84d732ce901ddd3ac6b415f (git)
Affected: 18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee , < 1e41e693f458eef2d5728207dbd327cd3b16580a (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.27
Unaffected: 0 , < 2.6.27 (semver)
Unaffected: 4.9.332 , ≤ 4.9.* (semver)
Unaffected: 4.14.298 , ≤ 4.14.* (semver)
Unaffected: 4.19.264 , ≤ 4.19.* (semver)
Unaffected: 5.4.221 , ≤ 5.4.* (semver)
Unaffected: 5.10.152 , ≤ 5.10.* (semver)
Unaffected: 5.15.76 , ≤ 5.15.* (semver)
Unaffected: 6.0.6 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/ata/ahci.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f70bd4339cb68bc7e206af4c922bc0d249244403",
              "status": "affected",
              "version": "18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee",
              "versionType": "git"
            },
            {
              "lessThan": "da2ea4a961d9f89ed248734e7032350c260dc3a3",
              "status": "affected",
              "version": "18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee",
              "versionType": "git"
            },
            {
              "lessThan": "67a00c299c5c143817c948fbc7de1a2fa1af38fb",
              "status": "affected",
              "version": "18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee",
              "versionType": "git"
            },
            {
              "lessThan": "383b7c50f5445ff8dbbf03080905648d6980c39d",
              "status": "affected",
              "version": "18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee",
              "versionType": "git"
            },
            {
              "lessThan": "303d0f761431d848dd8d7ff9fd9b8c101879cabe",
              "status": "affected",
              "version": "18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee",
              "versionType": "git"
            },
            {
              "lessThan": "8fbe13de1cc7cef2564be3cbf60400b33eee023b",
              "status": "affected",
              "version": "18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee",
              "versionType": "git"
            },
            {
              "lessThan": "d6314d5f68764550c84d732ce901ddd3ac6b415f",
              "status": "affected",
              "version": "18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee",
              "versionType": "git"
            },
            {
              "lessThan": "1e41e693f458eef2d5728207dbd327cd3b16580a",
              "status": "affected",
              "version": "18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/ata/ahci.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.27"
            },
            {
              "lessThan": "2.6.27",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.332",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.298",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.264",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.76",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.332",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.298",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.264",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.221",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.152",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.76",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.6",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS\n\nUBSAN complains about array-index-out-of-bounds:\n[ 1.980703] kernel: UBSAN: array-index-out-of-bounds in /build/linux-9H675w/linux-5.15.0/drivers/ata/libahci.c:968:41\n[ 1.980709] kernel: index 15 is out of range for type \u0027ahci_em_priv [8]\u0027\n[ 1.980713] kernel: CPU: 0 PID: 209 Comm: scsi_eh_8 Not tainted 5.15.0-25-generic #25-Ubuntu\n[ 1.980716] kernel: Hardware name: System manufacturer System Product Name/P5Q3, BIOS 1102 06/11/2010\n[ 1.980718] kernel: Call Trace:\n[ 1.980721] kernel: \u003cTASK\u003e\n[ 1.980723] kernel: show_stack+0x52/0x58\n[ 1.980729] kernel: dump_stack_lvl+0x4a/0x5f\n[ 1.980734] kernel: dump_stack+0x10/0x12\n[ 1.980736] kernel: ubsan_epilogue+0x9/0x45\n[ 1.980739] kernel: __ubsan_handle_out_of_bounds.cold+0x44/0x49\n[ 1.980742] kernel: ahci_qc_issue+0x166/0x170 [libahci]\n[ 1.980748] kernel: ata_qc_issue+0x135/0x240\n[ 1.980752] kernel: ata_exec_internal_sg+0x2c4/0x580\n[ 1.980754] kernel: ? vprintk_default+0x1d/0x20\n[ 1.980759] kernel: ata_exec_internal+0x67/0xa0\n[ 1.980762] kernel: sata_pmp_read+0x8d/0xc0\n[ 1.980765] kernel: sata_pmp_read_gscr+0x3c/0x90\n[ 1.980768] kernel: sata_pmp_attach+0x8b/0x310\n[ 1.980771] kernel: ata_eh_revalidate_and_attach+0x28c/0x4b0\n[ 1.980775] kernel: ata_eh_recover+0x6b6/0xb30\n[ 1.980778] kernel: ? ahci_do_hardreset+0x180/0x180 [libahci]\n[ 1.980783] kernel: ? ahci_stop_engine+0xb0/0xb0 [libahci]\n[ 1.980787] kernel: ? ahci_do_softreset+0x290/0x290 [libahci]\n[ 1.980792] kernel: ? trace_event_raw_event_ata_eh_link_autopsy_qc+0xe0/0xe0\n[ 1.980795] kernel: sata_pmp_eh_recover.isra.0+0x214/0x560\n[ 1.980799] kernel: sata_pmp_error_handler+0x23/0x40\n[ 1.980802] kernel: ahci_error_handler+0x43/0x80 [libahci]\n[ 1.980806] kernel: ata_scsi_port_error_handler+0x2b1/0x600\n[ 1.980810] kernel: ata_scsi_error+0x9c/0xd0\n[ 1.980813] kernel: scsi_error_handler+0xa1/0x180\n[ 1.980817] kernel: ? scsi_unjam_host+0x1c0/0x1c0\n[ 1.980820] kernel: kthread+0x12a/0x150\n[ 1.980823] kernel: ? set_kthread_struct+0x50/0x50\n[ 1.980826] kernel: ret_from_fork+0x22/0x30\n[ 1.980831] kernel: \u003c/TASK\u003e\n\nThis happens because sata_pmp_init_links() initialize link-\u003epmp up to\nSATA_PMP_MAX_PORTS while em_priv is declared as 8 elements array.\n\nI can\u0027t find the maximum Enclosure Management ports specified in AHCI\nspec v1.3.1, but \"12.2.1 LED message type\" states that \"Port Multiplier\nInformation\" can utilize 4 bits, which implies it can support up to 16\nports. Hence, use SATA_PMP_MAX_PORTS as EM_MAX_SLOTS to resolve the\nissue.\n\nBugLink: https://bugs.launchpad.net/bugs/1970074"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The OOB is reached through AHCI enclosure-management paths on systems with a SATA port multiplier (common on NAS/DAS and eSATA setups). A local attacker triggers it via world-readable sysfs (em_message) and normal ATA/PMP command processing, without needing network access.\nAC:L - Once an AHCI host with enclosure management and a PMP is present, the out-of-bounds em_priv[link-\u003epmp] access is deterministic on PMP attach, LED sysfs reads, port resume, and I/O\u2014no race or other attacker-uncontrollable condition is required.\nPR:L - em_message is S_IRUGO, so an unprivileged local user can force OOB reads of adjacent kernel heap via ahci_led_show for PMP port indices \u003e= 8. Port resume and related EM paths that write past em_priv[] also do not require root capabilities beyond normal local access.\nUI:N - Exploitation does not need a victim to open a file or mount anything; attaching/operating the PMP and reading host sysfs attributes is sufficient, and the bug also fires from kernel EH/resume context without user interaction.\nS:U - Impact is confined to the host kernel\u2019s memory and control flow (heap OOB in ahci_port_priv). There is no VM/hypervisor escape or other cross-authority boundary crossing.\nC:H - ahci_led_show and related EM paths read em_priv[link-\u003epmp] past the 8-slot array into adjacent heap and return those values to userspace, enabling disclosure of kernel memory; heap corruption from the write paths can further yield arbitrary read primitives.\nI:H - For PMP indices \u003e= 8, ahci_init_sw_activity performs OOB writes (including timer_setup of a timer_list) into memory past em_priv[], and ahci_sw_activity/ahci_activity_store can likewise corrupt adjacent heap\u2014classic primitives for control-flow hijacking.\nA:H - Out-of-bounds heap reads/writes and corrupted timer_list state can oops/panic the kernel; the same paths run in SCSI error-handler/resume context where memory corruption reliably threatens system availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:58:09.941Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f70bd4339cb68bc7e206af4c922bc0d249244403"
        },
        {
          "url": "https://git.kernel.org/stable/c/da2ea4a961d9f89ed248734e7032350c260dc3a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/67a00c299c5c143817c948fbc7de1a2fa1af38fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/383b7c50f5445ff8dbbf03080905648d6980c39d"
        },
        {
          "url": "https://git.kernel.org/stable/c/303d0f761431d848dd8d7ff9fd9b8c101879cabe"
        },
        {
          "url": "https://git.kernel.org/stable/c/8fbe13de1cc7cef2564be3cbf60400b33eee023b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d6314d5f68764550c84d732ce901ddd3ac6b415f"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e41e693f458eef2d5728207dbd327cd3b16580a"
        }
      ],
      "title": "ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50315",
    "datePublished": "2025-09-15T14:46:10.177Z",
    "dateReserved": "2025-09-15T14:18:36.813Z",
    "dateUpdated": "2026-08-05T08:58:09.941Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50315",
      "date": "2026-10-01",
      "epss": "0.00164",
      "percentile": "0.0506"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/ata/ahci.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "f70bd4339cb68bc7e206af4c922bc0d249244403",
                    "status": "affected",
                    "version": "18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "da2ea4a961d9f89ed248734e7032350c260dc3a3",
                    "status": "affected",
                    "version": "18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "67a00c299c5c143817c948fbc7de1a2fa1af38fb",
                    "status": "affected",
                    "version": "18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "383b7c50f5445ff8dbbf03080905648d6980c39d",
                    "status": "affected",
                    "version": "18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "303d0f761431d848dd8d7ff9fd9b8c101879cabe",
                    "status": "affected",
                    "version": "18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8fbe13de1cc7cef2564be3cbf60400b33eee023b",
                    "status": "affected",
                    "version": "18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d6314d5f68764550c84d732ce901ddd3ac6b415f",
                    "status": "affected",
                    "version": "18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1e41e693f458eef2d5728207dbd327cd3b16580a",
                    "status": "affected",
                    "version": "18f7ba4c2f4be6b37d925931f04d6cc28d88d1ee",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/ata/ahci.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.27"
                  },
                  {
                    "lessThan": "2.6.27",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.9.*",
                    "status": "unaffected",
                    "version": "4.9.332",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.14.*",
                    "status": "unaffected",
                    "version": "4.14.298",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.264",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.152",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.76",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.0.*",
                    "status": "unaffected",
                    "version": "6.0.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4FBDCD91-2083-441C-B3A3-FE1E7B2054DD",
                    "versionEndExcluding": "4.9.332",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7140B9A2-EB63-497C-96B1-68A96CD99051",
                    "versionEndExcluding": "4.14.298",
                    "versionStartIncluding": "4.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8AE23A9F-BF98-4055-AA49-02118B96226D",
                    "versionEndExcluding": "4.19.264",
                    "versionStartIncluding": "4.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DF527781-6E98-4DBF-B668-377AA673CDCF",
                    "versionEndExcluding": "5.4.221",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AFE2A429-A1A8-4B68-8F1D-A1595AB6A4F7",
                    "versionEndExcluding": "5.10.152",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "918A4953-6F82-40F5-B7A9-9836905139C1",
                    "versionEndExcluding": "5.15.76",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "98F5FA4A-A33F-4FAD-894E-FDC9D295742A",
                    "versionEndExcluding": "6.0.6",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "E7E331DA-1FB0-4DEC-91AC-7DA69D461C11",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS\n\nUBSAN complains about array-index-out-of-bounds:\n[ 1.980703] kernel: UBSAN: array-index-out-of-bounds in /build/linux-9H675w/linux-5.15.0/drivers/ata/libahci.c:968:41\n[ 1.980709] kernel: index 15 is out of range for type \u0027ahci_em_priv [8]\u0027\n[ 1.980713] kernel: CPU: 0 PID: 209 Comm: scsi_eh_8 Not tainted 5.15.0-25-generic #25-Ubuntu\n[ 1.980716] kernel: Hardware name: System manufacturer System Product Name/P5Q3, BIOS 1102 06/11/2010\n[ 1.980718] kernel: Call Trace:\n[ 1.980721] kernel: \u003cTASK\u003e\n[ 1.980723] kernel: show_stack+0x52/0x58\n[ 1.980729] kernel: dump_stack_lvl+0x4a/0x5f\n[ 1.980734] kernel: dump_stack+0x10/0x12\n[ 1.980736] kernel: ubsan_epilogue+0x9/0x45\n[ 1.980739] kernel: __ubsan_handle_out_of_bounds.cold+0x44/0x49\n[ 1.980742] kernel: ahci_qc_issue+0x166/0x170 [libahci]\n[ 1.980748] kernel: ata_qc_issue+0x135/0x240\n[ 1.980752] kernel: ata_exec_internal_sg+0x2c4/0x580\n[ 1.980754] kernel: ? vprintk_default+0x1d/0x20\n[ 1.980759] kernel: ata_exec_internal+0x67/0xa0\n[ 1.980762] kernel: sata_pmp_read+0x8d/0xc0\n[ 1.980765] kernel: sata_pmp_read_gscr+0x3c/0x90\n[ 1.980768] kernel: sata_pmp_attach+0x8b/0x310\n[ 1.980771] kernel: ata_eh_revalidate_and_attach+0x28c/0x4b0\n[ 1.980775] kernel: ata_eh_recover+0x6b6/0xb30\n[ 1.980778] kernel: ? ahci_do_hardreset+0x180/0x180 [libahci]\n[ 1.980783] kernel: ? ahci_stop_engine+0xb0/0xb0 [libahci]\n[ 1.980787] kernel: ? ahci_do_softreset+0x290/0x290 [libahci]\n[ 1.980792] kernel: ? trace_event_raw_event_ata_eh_link_autopsy_qc+0xe0/0xe0\n[ 1.980795] kernel: sata_pmp_eh_recover.isra.0+0x214/0x560\n[ 1.980799] kernel: sata_pmp_error_handler+0x23/0x40\n[ 1.980802] kernel: ahci_error_handler+0x43/0x80 [libahci]\n[ 1.980806] kernel: ata_scsi_port_error_handler+0x2b1/0x600\n[ 1.980810] kernel: ata_scsi_error+0x9c/0xd0\n[ 1.980813] kernel: scsi_error_handler+0xa1/0x180\n[ 1.980817] kernel: ? scsi_unjam_host+0x1c0/0x1c0\n[ 1.980820] kernel: kthread+0x12a/0x150\n[ 1.980823] kernel: ? set_kthread_struct+0x50/0x50\n[ 1.980826] kernel: ret_from_fork+0x22/0x30\n[ 1.980831] kernel: \u003c/TASK\u003e\n\nThis happens because sata_pmp_init_links() initialize link-\u003epmp up to\nSATA_PMP_MAX_PORTS while em_priv is declared as 8 elements array.\n\nI can\u0027t find the maximum Enclosure Management ports specified in AHCI\nspec v1.3.1, but \"12.2.1 LED message type\" states that \"Port Multiplier\nInformation\" can utilize 4 bits, which implies it can support up to 16\nports. Hence, use SATA_PMP_MAX_PORTS as EM_MAX_SLOTS to resolve the\nissue.\n\nBugLink: https://bugs.launchpad.net/bugs/1970074"
          }
        ],
        "id": "CVE-2022-50315",
        "lastModified": "2026-08-04T10:18:10.803",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-09-15T15:15:43.373",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1e41e693f458eef2d5728207dbd327cd3b16580a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/303d0f761431d848dd8d7ff9fd9b8c101879cabe"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/383b7c50f5445ff8dbbf03080905648d6980c39d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/67a00c299c5c143817c948fbc7de1a2fa1af38fb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8fbe13de1cc7cef2564be3cbf60400b33eee023b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d6314d5f68764550c84d732ce901ddd3ac6b415f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/da2ea4a961d9f89ed248734e7032350c260dc3a3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f70bd4339cb68bc7e206af4c922bc0d249244403"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-129"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:40:59+00:00",
      "cve": "CVE-2022-50315",
      "id": "CVE-2022-50315",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50315.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-05T00:54:44Z",
      "cve": "CVE-2022-50315",
      "id": "CVE-2022-50315",
      "initial_release_date": "2025-09-15T23:29:17Z",
      "product_status:known_affected": "390",
      "product_status:known_not_affected": "174",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50315",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50315.json",
      "version": "18"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.