CVE-2022-50373 (GCVE-0-2022-50373)

Vulnerability from cvelistv5 – Published: 2025-09-17 14:56 – Updated: 2026-08-05 08:58
VLAI
Title
fs: dlm: fix race in lowcomms
Summary
In the Linux kernel, the following vulnerability has been resolved: fs: dlm: fix race in lowcomms This patch fixes a race between queue_work() in _dlm_lowcomms_commit_msg() and srcu_read_unlock(). The queue_work() can take the final reference of a dlm_msg and so msg->idx can contain garbage which is signaled by the following warning: [ 676.237050] ------------[ cut here ]------------ [ 676.237052] WARNING: CPU: 0 PID: 1060 at include/linux/srcu.h:189 dlm_lowcomms_commit_msg+0x41/0x50 [ 676.238945] Modules linked in: dlm_locktorture torture rpcsec_gss_krb5 intel_rapl_msr intel_rapl_common iTCO_wdt iTCO_vendor_support qxl kvm_intel drm_ttm_helper vmw_vsock_virtio_transport kvm vmw_vsock_virtio_transport_common ttm irqbypass crc32_pclmul joydev crc32c_intel serio_raw drm_kms_helper vsock virtio_scsi virtio_console virtio_balloon snd_pcm drm syscopyarea sysfillrect sysimgblt snd_timer fb_sys_fops i2c_i801 lpc_ich snd i2c_smbus soundcore pcspkr [ 676.244227] CPU: 0 PID: 1060 Comm: lock_torture_wr Not tainted 5.19.0-rc3+ #1546 [ 676.245216] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-2.module+el8.7.0+15506+033991b0 04/01/2014 [ 676.246460] RIP: 0010:dlm_lowcomms_commit_msg+0x41/0x50 [ 676.247132] Code: fe ff ff ff 75 24 48 c7 c6 bd 0f 49 bb 48 c7 c7 38 7c 01 bd e8 00 e7 ca ff 89 de 48 c7 c7 60 78 01 bd e8 42 3d cd ff 5b 5d c3 <0f> 0b eb d8 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 [ 676.249253] RSP: 0018:ffffa401c18ffc68 EFLAGS: 00010282 [ 676.249855] RAX: 0000000000000001 RBX: 00000000ffff8b76 RCX: 0000000000000006 [ 676.250713] RDX: 0000000000000000 RSI: ffffffffbccf3a10 RDI: ffffffffbcc7b62e [ 676.251610] RBP: ffffa401c18ffc70 R08: 0000000000000001 R09: 0000000000000001 [ 676.252481] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000005 [ 676.253421] R13: ffff8b76786ec370 R14: ffff8b76786ec370 R15: ffff8b76786ec480 [ 676.254257] FS: 0000000000000000(0000) GS:ffff8b7777800000(0000) knlGS:0000000000000000 [ 676.255239] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 676.255897] CR2: 00005590205d88b8 CR3: 000000017656c003 CR4: 0000000000770ee0 [ 676.256734] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 676.257567] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 676.258397] PKRU: 55555554 [ 676.258729] Call Trace: [ 676.259063] <TASK> [ 676.259354] dlm_midcomms_commit_mhandle+0xcc/0x110 [ 676.259964] queue_bast+0x8b/0xb0 [ 676.260423] grant_pending_locks+0x166/0x1b0 [ 676.261007] _unlock_lock+0x75/0x90 [ 676.261469] unlock_lock.isra.57+0x62/0xa0 [ 676.262009] dlm_unlock+0x21e/0x330 [ 676.262457] ? lock_torture_stats+0x80/0x80 [dlm_locktorture] [ 676.263183] torture_unlock+0x5a/0x90 [dlm_locktorture] [ 676.263815] ? preempt_count_sub+0xba/0x100 [ 676.264361] ? complete+0x1d/0x60 [ 676.264777] lock_torture_writer+0xb8/0x150 [dlm_locktorture] [ 676.265555] kthread+0x10a/0x130 [ 676.266007] ? kthread_complete_and_exit+0x20/0x20 [ 676.266616] ret_from_fork+0x22/0x30 [ 676.267097] </TASK> [ 676.267381] irq event stamp: 9579855 [ 676.267824] hardirqs last enabled at (9579863): [<ffffffffbb14e6f8>] __up_console_sem+0x58/0x60 [ 676.268896] hardirqs last disabled at (9579872): [<ffffffffbb14e6dd>] __up_console_sem+0x3d/0x60 [ 676.270008] softirqs last enabled at (9579798): [<ffffffffbc200349>] __do_softirq+0x349/0x4c7 [ 676.271438] softirqs last disabled at (9579897): [<ffffffffbb0d54c0>] irq_exit_rcu+0xb0/0xf0 [ 676.272796] ---[ end trace 0000000000000000 ]--- I reproduced this warning with dlm_locktorture test which is currently not upstream. However this patch fix the issue by make a additional refcount between dlm_lowcomms_new_msg() and dlm_lowcomms_commit_msg(). In case of the race the kref_put() in dlm_lowcomms_commit_msg() will be the final put.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 18:36 UTC
CWE
  • CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b38bc9c2b3171f4411d80015ecb876bc6f9bcd26 , < 27d3e646dd83bafd7094890462eebfce3ac31e4a (git)
Affected: b38bc9c2b3171f4411d80015ecb876bc6f9bcd26 , < eb97e60a9eae632ff9104a580dbc4fdc58dc23cb (git)
Affected: b38bc9c2b3171f4411d80015ecb876bc6f9bcd26 , < de7fdff754bb4d01e38e19964c309b6df6a79472 (git)
Affected: b38bc9c2b3171f4411d80015ecb876bc6f9bcd26 , < 30ea3257e8766027c4d8d609dcbd256ff9a76073 (git)
Affected: 7ae861bbfa0f69bd36bdff47f9755ad67a2bd219 (git)
Affected: 5.13.2 , < 5.14 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.15.75 , ≤ 5.15.* (semver)
Unaffected: 5.19.17 , ≤ 5.19.* (semver)
Unaffected: 6.0.3 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 4.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-50373",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:36:47.932587Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T18:43:00.519Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/dlm/lowcomms.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "27d3e646dd83bafd7094890462eebfce3ac31e4a",
              "status": "affected",
              "version": "b38bc9c2b3171f4411d80015ecb876bc6f9bcd26",
              "versionType": "git"
            },
            {
              "lessThan": "eb97e60a9eae632ff9104a580dbc4fdc58dc23cb",
              "status": "affected",
              "version": "b38bc9c2b3171f4411d80015ecb876bc6f9bcd26",
              "versionType": "git"
            },
            {
              "lessThan": "de7fdff754bb4d01e38e19964c309b6df6a79472",
              "status": "affected",
              "version": "b38bc9c2b3171f4411d80015ecb876bc6f9bcd26",
              "versionType": "git"
            },
            {
              "lessThan": "30ea3257e8766027c4d8d609dcbd256ff9a76073",
              "status": "affected",
              "version": "b38bc9c2b3171f4411d80015ecb876bc6f9bcd26",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7ae861bbfa0f69bd36bdff47f9755ad67a2bd219",
              "versionType": "git"
            },
            {
              "lessThan": "5.14",
              "status": "affected",
              "version": "5.13.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/dlm/lowcomms.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.75",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.17",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.3",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.13.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: dlm: fix race in lowcomms\n\nThis patch fixes a race between queue_work() in\n_dlm_lowcomms_commit_msg() and srcu_read_unlock(). The queue_work() can\ntake the final reference of a dlm_msg and so msg-\u003eidx can contain\ngarbage which is signaled by the following warning:\n\n[  676.237050] ------------[ cut here ]------------\n[  676.237052] WARNING: CPU: 0 PID: 1060 at include/linux/srcu.h:189 dlm_lowcomms_commit_msg+0x41/0x50\n[  676.238945] Modules linked in: dlm_locktorture torture rpcsec_gss_krb5 intel_rapl_msr intel_rapl_common iTCO_wdt iTCO_vendor_support qxl kvm_intel drm_ttm_helper vmw_vsock_virtio_transport kvm vmw_vsock_virtio_transport_common ttm irqbypass crc32_pclmul joydev crc32c_intel serio_raw drm_kms_helper vsock virtio_scsi virtio_console virtio_balloon snd_pcm drm syscopyarea sysfillrect sysimgblt snd_timer fb_sys_fops i2c_i801 lpc_ich snd i2c_smbus soundcore pcspkr\n[  676.244227] CPU: 0 PID: 1060 Comm: lock_torture_wr Not tainted 5.19.0-rc3+ #1546\n[  676.245216] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-2.module+el8.7.0+15506+033991b0 04/01/2014\n[  676.246460] RIP: 0010:dlm_lowcomms_commit_msg+0x41/0x50\n[  676.247132] Code: fe ff ff ff 75 24 48 c7 c6 bd 0f 49 bb 48 c7 c7 38 7c 01 bd e8 00 e7 ca ff 89 de 48 c7 c7 60 78 01 bd e8 42 3d cd ff 5b 5d c3 \u003c0f\u003e 0b eb d8 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48\n[  676.249253] RSP: 0018:ffffa401c18ffc68 EFLAGS: 00010282\n[  676.249855] RAX: 0000000000000001 RBX: 00000000ffff8b76 RCX: 0000000000000006\n[  676.250713] RDX: 0000000000000000 RSI: ffffffffbccf3a10 RDI: ffffffffbcc7b62e\n[  676.251610] RBP: ffffa401c18ffc70 R08: 0000000000000001 R09: 0000000000000001\n[  676.252481] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000005\n[  676.253421] R13: ffff8b76786ec370 R14: ffff8b76786ec370 R15: ffff8b76786ec480\n[  676.254257] FS:  0000000000000000(0000) GS:ffff8b7777800000(0000) knlGS:0000000000000000\n[  676.255239] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  676.255897] CR2: 00005590205d88b8 CR3: 000000017656c003 CR4: 0000000000770ee0\n[  676.256734] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  676.257567] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[  676.258397] PKRU: 55555554\n[  676.258729] Call Trace:\n[  676.259063]  \u003cTASK\u003e\n[  676.259354]  dlm_midcomms_commit_mhandle+0xcc/0x110\n[  676.259964]  queue_bast+0x8b/0xb0\n[  676.260423]  grant_pending_locks+0x166/0x1b0\n[  676.261007]  _unlock_lock+0x75/0x90\n[  676.261469]  unlock_lock.isra.57+0x62/0xa0\n[  676.262009]  dlm_unlock+0x21e/0x330\n[  676.262457]  ? lock_torture_stats+0x80/0x80 [dlm_locktorture]\n[  676.263183]  torture_unlock+0x5a/0x90 [dlm_locktorture]\n[  676.263815]  ? preempt_count_sub+0xba/0x100\n[  676.264361]  ? complete+0x1d/0x60\n[  676.264777]  lock_torture_writer+0xb8/0x150 [dlm_locktorture]\n[  676.265555]  kthread+0x10a/0x130\n[  676.266007]  ? kthread_complete_and_exit+0x20/0x20\n[  676.266616]  ret_from_fork+0x22/0x30\n[  676.267097]  \u003c/TASK\u003e\n[  676.267381] irq event stamp: 9579855\n[  676.267824] hardirqs last  enabled at (9579863): [\u003cffffffffbb14e6f8\u003e] __up_console_sem+0x58/0x60\n[  676.268896] hardirqs last disabled at (9579872): [\u003cffffffffbb14e6dd\u003e] __up_console_sem+0x3d/0x60\n[  676.270008] softirqs last  enabled at (9579798): [\u003cffffffffbc200349\u003e] __do_softirq+0x349/0x4c7\n[  676.271438] softirqs last disabled at (9579897): [\u003cffffffffbb0d54c0\u003e] irq_exit_rcu+0xb0/0xf0\n[  676.272796] ---[ end trace 0000000000000000 ]---\n\nI reproduced this warning with dlm_locktorture test which is currently\nnot upstream. However this patch fix the issue by make a additional\nrefcount between dlm_lowcomms_new_msg() and dlm_lowcomms_commit_msg().\nIn case of the race the kref_put() in dlm_lowcomms_commit_msg() will be\nthe final put."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The race is hit when the local node commits outbound DLM messages (e.g. BASTs from grant_pending_locks), which remote peers induce by sending lock/unlock traffic over the DLM TCP/SCTP transport on port 21064; that is the same network-reachable midcomms/lowcomms path scored AV:N for related DLM CVEs.\nAC:L - A peer can drive both sides by flooding concurrent lock operations so many commit_msg calls race with the send workqueue that frees dlm_msg; the locktorture repro shows this is reliably hittable under attacker-controlled load rather than a one-shot environmental fluke.\nPR:N - DLM lowcomms has no authentication or TLS in the affected versions\u2014only an IP-to-nodeid allowlist\u2014so a cluster peer, compromised node, or address-spoofing attacker needs no account or privilege on the victim.\nUI:N - Crafted or concurrent peer lock messages are processed by DLM receive/send workqueues on an already-running cluster with no victim user action required.\nS:U - Corruption stays in host kernel memory (freed dlm_msg and SRCU per-CPU counters) within one security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free of a kmem_cache-backed dlm_msg; after free, msg-\u003eidx and related fields can be groomed/reused so subsequent reads of the stale object yield an attacker-steerable kernel read primitive.\nI:H - srcu_read_unlock() uses the freed msg-\u003eidx in this_cpu_inc(srcu_unlock_count[idx]) on a size-2 array, giving an out-of-bounds write when idx is garbage, which is exploitable for memory corruption and control-flow hijack as with the related midcomms UAF.\nA:H - The UAF produces WARN/oops paths (as in the reported srcu.h warning) and corrupted SRCU accounting that can panic, hang DLM, or take down the clustered filesystem node."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:58:28.255Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/27d3e646dd83bafd7094890462eebfce3ac31e4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb97e60a9eae632ff9104a580dbc4fdc58dc23cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/de7fdff754bb4d01e38e19964c309b6df6a79472"
        },
        {
          "url": "https://git.kernel.org/stable/c/30ea3257e8766027c4d8d609dcbd256ff9a76073"
        }
      ],
      "title": "fs: dlm: fix race in lowcomms",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50373",
    "datePublished": "2025-09-17T14:56:28.282Z",
    "dateReserved": "2025-09-17T14:53:06.995Z",
    "dateUpdated": "2026-08-05T08:58:28.255Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50373",
      "date": "2026-09-25",
      "epss": "0.00392",
      "percentile": "0.30643"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/dlm/lowcomms.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "27d3e646dd83bafd7094890462eebfce3ac31e4a",
                    "status": "affected",
                    "version": "b38bc9c2b3171f4411d80015ecb876bc6f9bcd26",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "eb97e60a9eae632ff9104a580dbc4fdc58dc23cb",
                    "status": "affected",
                    "version": "b38bc9c2b3171f4411d80015ecb876bc6f9bcd26",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "de7fdff754bb4d01e38e19964c309b6df6a79472",
                    "status": "affected",
                    "version": "b38bc9c2b3171f4411d80015ecb876bc6f9bcd26",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "30ea3257e8766027c4d8d609dcbd256ff9a76073",
                    "status": "affected",
                    "version": "b38bc9c2b3171f4411d80015ecb876bc6f9bcd26",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "7ae861bbfa0f69bd36bdff47f9755ad67a2bd219",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.14",
                    "status": "affected",
                    "version": "5.13.2",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/dlm/lowcomms.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.14"
                  },
                  {
                    "lessThan": "5.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.75",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.19.*",
                    "status": "unaffected",
                    "version": "5.19.17",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.0.*",
                    "status": "unaffected",
                    "version": "6.0.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9C6956B2-4DF8-4582-B8E4-66E19910BE4C",
                    "versionEndExcluding": "5.15.75",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "19B4C3A4-E5C3-41DC-BB14-BE72858E7D35",
                    "versionEndExcluding": "5.19.17",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5BCD8201-B847-4442-B894-70D430128DEF",
                    "versionEndExcluding": "6.0.3",
                    "versionStartIncluding": "6.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: dlm: fix race in lowcomms\n\nThis patch fixes a race between queue_work() in\n_dlm_lowcomms_commit_msg() and srcu_read_unlock(). The queue_work() can\ntake the final reference of a dlm_msg and so msg-\u003eidx can contain\ngarbage which is signaled by the following warning:\n\n[  676.237050] ------------[ cut here ]------------\n[  676.237052] WARNING: CPU: 0 PID: 1060 at include/linux/srcu.h:189 dlm_lowcomms_commit_msg+0x41/0x50\n[  676.238945] Modules linked in: dlm_locktorture torture rpcsec_gss_krb5 intel_rapl_msr intel_rapl_common iTCO_wdt iTCO_vendor_support qxl kvm_intel drm_ttm_helper vmw_vsock_virtio_transport kvm vmw_vsock_virtio_transport_common ttm irqbypass crc32_pclmul joydev crc32c_intel serio_raw drm_kms_helper vsock virtio_scsi virtio_console virtio_balloon snd_pcm drm syscopyarea sysfillrect sysimgblt snd_timer fb_sys_fops i2c_i801 lpc_ich snd i2c_smbus soundcore pcspkr\n[  676.244227] CPU: 0 PID: 1060 Comm: lock_torture_wr Not tainted 5.19.0-rc3+ #1546\n[  676.245216] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-2.module+el8.7.0+15506+033991b0 04/01/2014\n[  676.246460] RIP: 0010:dlm_lowcomms_commit_msg+0x41/0x50\n[  676.247132] Code: fe ff ff ff 75 24 48 c7 c6 bd 0f 49 bb 48 c7 c7 38 7c 01 bd e8 00 e7 ca ff 89 de 48 c7 c7 60 78 01 bd e8 42 3d cd ff 5b 5d c3 \u003c0f\u003e 0b eb d8 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48\n[  676.249253] RSP: 0018:ffffa401c18ffc68 EFLAGS: 00010282\n[  676.249855] RAX: 0000000000000001 RBX: 00000000ffff8b76 RCX: 0000000000000006\n[  676.250713] RDX: 0000000000000000 RSI: ffffffffbccf3a10 RDI: ffffffffbcc7b62e\n[  676.251610] RBP: ffffa401c18ffc70 R08: 0000000000000001 R09: 0000000000000001\n[  676.252481] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000005\n[  676.253421] R13: ffff8b76786ec370 R14: ffff8b76786ec370 R15: ffff8b76786ec480\n[  676.254257] FS:  0000000000000000(0000) GS:ffff8b7777800000(0000) knlGS:0000000000000000\n[  676.255239] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  676.255897] CR2: 00005590205d88b8 CR3: 000000017656c003 CR4: 0000000000770ee0\n[  676.256734] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  676.257567] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[  676.258397] PKRU: 55555554\n[  676.258729] Call Trace:\n[  676.259063]  \u003cTASK\u003e\n[  676.259354]  dlm_midcomms_commit_mhandle+0xcc/0x110\n[  676.259964]  queue_bast+0x8b/0xb0\n[  676.260423]  grant_pending_locks+0x166/0x1b0\n[  676.261007]  _unlock_lock+0x75/0x90\n[  676.261469]  unlock_lock.isra.57+0x62/0xa0\n[  676.262009]  dlm_unlock+0x21e/0x330\n[  676.262457]  ? lock_torture_stats+0x80/0x80 [dlm_locktorture]\n[  676.263183]  torture_unlock+0x5a/0x90 [dlm_locktorture]\n[  676.263815]  ? preempt_count_sub+0xba/0x100\n[  676.264361]  ? complete+0x1d/0x60\n[  676.264777]  lock_torture_writer+0xb8/0x150 [dlm_locktorture]\n[  676.265555]  kthread+0x10a/0x130\n[  676.266007]  ? kthread_complete_and_exit+0x20/0x20\n[  676.266616]  ret_from_fork+0x22/0x30\n[  676.267097]  \u003c/TASK\u003e\n[  676.267381] irq event stamp: 9579855\n[  676.267824] hardirqs last  enabled at (9579863): [\u003cffffffffbb14e6f8\u003e] __up_console_sem+0x58/0x60\n[  676.268896] hardirqs last disabled at (9579872): [\u003cffffffffbb14e6dd\u003e] __up_console_sem+0x3d/0x60\n[  676.270008] softirqs last  enabled at (9579798): [\u003cffffffffbc200349\u003e] __do_softirq+0x349/0x4c7\n[  676.271438] softirqs last disabled at (9579897): [\u003cffffffffbb0d54c0\u003e] irq_exit_rcu+0xb0/0xf0\n[  676.272796] ---[ end trace 0000000000000000 ]---\n\nI reproduced this warning with dlm_locktorture test which is currently\nnot upstream. However this patch fix the issue by make a additional\nrefcount between dlm_lowcomms_new_msg() and dlm_lowcomms_commit_msg().\nIn case of the race the kref_put() in dlm_lowcomms_commit_msg() will be\nthe final put."
          }
        ],
        "id": "CVE-2022-50373",
        "lastModified": "2026-08-04T10:18:13.600",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-50373",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:36:47.932587Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-09-17T15:15:36.303",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/27d3e646dd83bafd7094890462eebfce3ac31e4a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/30ea3257e8766027c4d8d609dcbd256ff9a76073"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/de7fdff754bb4d01e38e19964c309b6df6a79472"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/eb97e60a9eae632ff9104a580dbc4fdc58dc23cb"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-362"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-362"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T21:48:54+00:00",
      "cve": "CVE-2022-50373",
      "id": "CVE-2022-50373",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: fs: dlm: fix race in lowcomms",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50373.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T16:51:04Z",
      "cve": "CVE-2022-50373",
      "id": "CVE-2022-50373",
      "initial_release_date": "2025-09-22T23:42:33Z",
      "product_status:known_affected": "344",
      "product_status:known_not_affected": "395",
      "product_status:recommended": "206",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50373",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50373.json",
      "version": "32"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "HIGH",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 4.7,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-50373",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-01-14T18:36:47.932587Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-362",
                    "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-01-14T18:36:43.623Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "fs/dlm/lowcomms.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "27d3e646dd83bafd7094890462eebfce3ac31e4a",
                  "status": "affected",
                  "version": "b38bc9c2b3171f4411d80015ecb876bc6f9bcd26",
                  "versionType": "git"
                },
                {
                  "lessThan": "eb97e60a9eae632ff9104a580dbc4fdc58dc23cb",
                  "status": "affected",
                  "version": "b38bc9c2b3171f4411d80015ecb876bc6f9bcd26",
                  "versionType": "git"
                },
                {
                  "lessThan": "de7fdff754bb4d01e38e19964c309b6df6a79472",
                  "status": "affected",
                  "version": "b38bc9c2b3171f4411d80015ecb876bc6f9bcd26",
                  "versionType": "git"
                },
                {
                  "lessThan": "30ea3257e8766027c4d8d609dcbd256ff9a76073",
                  "status": "affected",
                  "version": "b38bc9c2b3171f4411d80015ecb876bc6f9bcd26",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "7ae861bbfa0f69bd36bdff47f9755ad67a2bd219",
                  "versionType": "git"
                },
                {
                  "lessThan": "5.14",
                  "status": "affected",
                  "version": "5.13.2",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "fs/dlm/lowcomms.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.14"
                },
                {
                  "lessThan": "5.14",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.75",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.19.*",
                  "status": "unaffected",
                  "version": "5.19.17",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.0.*",
                  "status": "unaffected",
                  "version": "6.0.3",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.1",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.75",
                      "versionStartIncluding": "5.14",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.19.17",
                      "versionStartIncluding": "5.14",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.0.3",
                      "versionStartIncluding": "5.14",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1",
                      "versionStartIncluding": "5.14",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "5.13.2",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: dlm: fix race in lowcomms\n\nThis patch fixes a race between queue_work() in\n_dlm_lowcomms_commit_msg() and srcu_read_unlock(). The queue_work() can\ntake the final reference of a dlm_msg and so msg-\u003eidx can contain\ngarbage which is signaled by the following warning:\n\n[  676.237050] ------------[ cut here ]------------\n[  676.237052] WARNING: CPU: 0 PID: 1060 at include/linux/srcu.h:189 dlm_lowcomms_commit_msg+0x41/0x50\n[  676.238945] Modules linked in: dlm_locktorture torture rpcsec_gss_krb5 intel_rapl_msr intel_rapl_common iTCO_wdt iTCO_vendor_support qxl kvm_intel drm_ttm_helper vmw_vsock_virtio_transport kvm vmw_vsock_virtio_transport_common ttm irqbypass crc32_pclmul joydev crc32c_intel serio_raw drm_kms_helper vsock virtio_scsi virtio_console virtio_balloon snd_pcm drm syscopyarea sysfillrect sysimgblt snd_timer fb_sys_fops i2c_i801 lpc_ich snd i2c_smbus soundcore pcspkr\n[  676.244227] CPU: 0 PID: 1060 Comm: lock_torture_wr Not tainted 5.19.0-rc3+ #1546\n[  676.245216] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-2.module+el8.7.0+15506+033991b0 04/01/2014\n[  676.246460] RIP: 0010:dlm_lowcomms_commit_msg+0x41/0x50\n[  676.247132] Code: fe ff ff ff 75 24 48 c7 c6 bd 0f 49 bb 48 c7 c7 38 7c 01 bd e8 00 e7 ca ff 89 de 48 c7 c7 60 78 01 bd e8 42 3d cd ff 5b 5d c3 \u003c0f\u003e 0b eb d8 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48\n[  676.249253] RSP: 0018:ffffa401c18ffc68 EFLAGS: 00010282\n[  676.249855] RAX: 0000000000000001 RBX: 00000000ffff8b76 RCX: 0000000000000006\n[  676.250713] RDX: 0000000000000000 RSI: ffffffffbccf3a10 RDI: ffffffffbcc7b62e\n[  676.251610] RBP: ffffa401c18ffc70 R08: 0000000000000001 R09: 0000000000000001\n[  676.252481] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000005\n[  676.253421] R13: ffff8b76786ec370 R14: ffff8b76786ec370 R15: ffff8b76786ec480\n[  676.254257] FS:  0000000000000000(0000) GS:ffff8b7777800000(0000) knlGS:0000000000000000\n[  676.255239] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  676.255897] CR2: 00005590205d88b8 CR3: 000000017656c003 CR4: 0000000000770ee0\n[  676.256734] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[  676.257567] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[  676.258397] PKRU: 55555554\n[  676.258729] Call Trace:\n[  676.259063]  \u003cTASK\u003e\n[  676.259354]  dlm_midcomms_commit_mhandle+0xcc/0x110\n[  676.259964]  queue_bast+0x8b/0xb0\n[  676.260423]  grant_pending_locks+0x166/0x1b0\n[  676.261007]  _unlock_lock+0x75/0x90\n[  676.261469]  unlock_lock.isra.57+0x62/0xa0\n[  676.262009]  dlm_unlock+0x21e/0x330\n[  676.262457]  ? lock_torture_stats+0x80/0x80 [dlm_locktorture]\n[  676.263183]  torture_unlock+0x5a/0x90 [dlm_locktorture]\n[  676.263815]  ? preempt_count_sub+0xba/0x100\n[  676.264361]  ? complete+0x1d/0x60\n[  676.264777]  lock_torture_writer+0xb8/0x150 [dlm_locktorture]\n[  676.265555]  kthread+0x10a/0x130\n[  676.266007]  ? kthread_complete_and_exit+0x20/0x20\n[  676.266616]  ret_from_fork+0x22/0x30\n[  676.267097]  \u003c/TASK\u003e\n[  676.267381] irq event stamp: 9579855\n[  676.267824] hardirqs last  enabled at (9579863): [\u003cffffffffbb14e6f8\u003e] __up_console_sem+0x58/0x60\n[  676.268896] hardirqs last disabled at (9579872): [\u003cffffffffbb14e6dd\u003e] __up_console_sem+0x3d/0x60\n[  676.270008] softirqs last  enabled at (9579798): [\u003cffffffffbc200349\u003e] __do_softirq+0x349/0x4c7\n[  676.271438] softirqs last disabled at (9579897): [\u003cffffffffbb0d54c0\u003e] irq_exit_rcu+0xb0/0xf0\n[  676.272796] ---[ end trace 0000000000000000 ]---\n\nI reproduced this warning with dlm_locktorture test which is currently\nnot upstream. However this patch fix the issue by make a additional\nrefcount between dlm_lowcomms_new_msg() and dlm_lowcomms_commit_msg().\nIn case of the race the kref_put() in dlm_lowcomms_commit_msg() will be\nthe final put."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:N - The race is hit when the local node commits outbound DLM messages (e.g. BASTs from grant_pending_locks), which remote peers induce by sending lock/unlock traffic over the DLM TCP/SCTP transport on port 21064; that is the same network-reachable midcomms/lowcomms path scored AV:N for related DLM CVEs.\nAC:L - A peer can drive both sides by flooding concurrent lock operations so many commit_msg calls race with the send workqueue that frees dlm_msg; the locktorture repro shows this is reliably hittable under attacker-controlled load rather than a one-shot environmental fluke.\nPR:N - DLM lowcomms has no authentication or TLS in the affected versions\u2014only an IP-to-nodeid allowlist\u2014so a cluster peer, compromised node, or address-spoofing attacker needs no account or privilege on the victim.\nUI:N - Crafted or concurrent peer lock messages are processed by DLM receive/send workqueues on an already-running cluster with no victim user action required.\nS:U - Corruption stays in host kernel memory (freed dlm_msg and SRCU per-CPU counters) within one security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free of a kmem_cache-backed dlm_msg; after free, msg-\u003eidx and related fields can be groomed/reused so subsequent reads of the stale object yield an attacker-steerable kernel read primitive.\nI:H - srcu_read_unlock() uses the freed msg-\u003eidx in this_cpu_inc(srcu_unlock_count[idx]) on a size-2 array, giving an out-of-bounds write when idx is garbage, which is exploitable for memory corruption and control-flow hijack as with the related midcomms UAF.\nA:H - The UAF produces WARN/oops paths (as in the reported srcu.h warning) and corrupted SRCU accounting that can panic, hang DLM, or take down the clustered filesystem node."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:58:28.255Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/27d3e646dd83bafd7094890462eebfce3ac31e4a"
            },
            {
              "url": "https://git.kernel.org/stable/c/eb97e60a9eae632ff9104a580dbc4fdc58dc23cb"
            },
            {
              "url": "https://git.kernel.org/stable/c/de7fdff754bb4d01e38e19964c309b6df6a79472"
            },
            {
              "url": "https://git.kernel.org/stable/c/30ea3257e8766027c4d8d609dcbd256ff9a76073"
            }
          ],
          "title": "fs: dlm: fix race in lowcomms",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2022-50373",
        "datePublished": "2025-09-17T14:56:28.282Z",
        "dateReserved": "2025-09-17T14:53:06.995Z",
        "dateUpdated": "2026-08-05T08:58:28.255Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.