GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50432 (GCVE-0-2022-50432)

Vulnerability from cvelistv5 – Published: 2025-10-01 11:42 – Updated: 2026-08-05 08:58
VLAI
Title
kernfs: fix use-after-free in __kernfs_remove
Summary
In the Linux kernel, the following vulnerability has been resolved: kernfs: fix use-after-free in __kernfs_remove Syzkaller managed to trigger concurrent calls to kernfs_remove_by_name_ns() for the same file resulting in a KASAN detected use-after-free. The race occurs when the root node is freed during kernfs_drain(). To prevent this acquire an additional reference for the root of the tree that is removed before calling __kernfs_remove(). Found by syzkaller with the following reproducer (slab_nomerge is required): syz_mount_image$ext4(0x0, &(0x7f0000000100)='./file0\x00', 0x100000, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0) close(r0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x800) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0), 0x408, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@mmap}, {@loose}, {@loose}, {@mmap}], [{@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@fsmagic={'fsmagic', 0x3d, 0x10001}}, {@dont_hash}]}}) Sample report: ================================================================== BUG: KASAN: use-after-free in kernfs_type include/linux/kernfs.h:335 [inline] BUG: KASAN: use-after-free in kernfs_leftmost_descendant fs/kernfs/dir.c:1261 [inline] BUG: KASAN: use-after-free in __kernfs_remove.part.0+0x843/0x960 fs/kernfs/dir.c:1369 Read of size 2 at addr ffff8880088807f0 by task syz-executor.2/857 CPU: 0 PID: 857 Comm: syz-executor.2 Not tainted 6.0.0-rc3-00363-g7726d4c3e60b #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x6e/0x91 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x5e/0x5e5 mm/kasan/report.c:433 kasan_report+0xa3/0x130 mm/kasan/report.c:495 kernfs_type include/linux/kernfs.h:335 [inline] kernfs_leftmost_descendant fs/kernfs/dir.c:1261 [inline] __kernfs_remove.part.0+0x843/0x960 fs/kernfs/dir.c:1369 __kernfs_remove fs/kernfs/dir.c:1356 [inline] kernfs_remove_by_name_ns+0x108/0x190 fs/kernfs/dir.c:1589 sysfs_slab_add+0x133/0x1e0 mm/slub.c:5943 __kmem_cache_create+0x3e0/0x550 mm/slub.c:4899 create_cache mm/slab_common.c:229 [inline] kmem_cache_create_usercopy+0x167/0x2a0 mm/slab_common.c:335 p9_client_create+0xd4d/0x1190 net/9p/client.c:993 v9fs_session_init+0x1e6/0x13c0 fs/9p/v9fs.c:408 v9fs_mount+0xb9/0xbd0 fs/9p/vfs_super.c:126 legacy_get_tree+0xf1/0x200 fs/fs_context.c:610 vfs_get_tree+0x85/0x2e0 fs/super.c:1530 do_new_mount fs/namespace.c:3040 [inline] path_mount+0x675/0x1d00 fs/namespace.c:3370 do_mount fs/namespace.c:3383 [inline] __do_sys_mount fs/namespace.c:3591 [inline] __se_sys_mount fs/namespace.c:3568 [inline] __x64_sys_mount+0x282/0x300 fs/namespace.c:3568 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f725f983aed Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f725f0f7028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f725faa3f80 RCX: 00007f725f983aed RDX: 00000000200000c0 RSI: 0000000020000040 RDI: 0000000000000000 RBP: 00007f725f9f419c R08: 0000000020000280 R09: 0000000000000000 R10: 0000000000000408 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000006 R14: 00007f725faa3f80 R15: 00007f725f0d7000 </TASK> Allocated by task 855: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:437 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:470 kasan_slab_alloc include/linux/kasan.h:224 [inline] slab_post_alloc_hook mm/slab.h:7 ---truncated---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 45a140e587f3d32d8d424ed940dffb61e1739047 , < 4dfd6a477a1525773469feaf3c514b2c0fef76b5 (git)
Affected: 45a140e587f3d32d8d424ed940dffb61e1739047 , < 02eb35131050735332658029082f61515b7dfe38 (git)
Affected: 45a140e587f3d32d8d424ed940dffb61e1739047 , < 028cf780743eea79abffa7206b9dcfc080ad3546 (git)
Affected: 45a140e587f3d32d8d424ed940dffb61e1739047 , < c78b0dc6fb7fb389d674e491fd376388cdfb1d53 (git)
Affected: 45a140e587f3d32d8d424ed940dffb61e1739047 , < 6f72a3977ba9d0e5491a5c01315204272e7f9c44 (git)
Affected: 45a140e587f3d32d8d424ed940dffb61e1739047 , < 94d2643df1e70a4c310ebb5e2c493eec33df1a06 (git)
Affected: 45a140e587f3d32d8d424ed940dffb61e1739047 , < af1b57cc39beca203559576b3046094fc9e5eb32 (git)
Affected: 45a140e587f3d32d8d424ed940dffb61e1739047 , < 4abc99652812a2ddf932f137515d5c5a04723538 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.14
Unaffected: 0 , < 3.14 (semver)
Unaffected: 4.9.332 , ≤ 4.9.* (semver)
Unaffected: 4.14.298 , ≤ 4.14.* (semver)
Unaffected: 4.19.264 , ≤ 4.19.* (semver)
Unaffected: 5.4.223 , ≤ 5.4.* (semver)
Unaffected: 5.10.153 , ≤ 5.10.* (semver)
Unaffected: 5.15.77 , ≤ 5.15.* (semver)
Unaffected: 6.0.7 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/kernfs/dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4dfd6a477a1525773469feaf3c514b2c0fef76b5",
              "status": "affected",
              "version": "45a140e587f3d32d8d424ed940dffb61e1739047",
              "versionType": "git"
            },
            {
              "lessThan": "02eb35131050735332658029082f61515b7dfe38",
              "status": "affected",
              "version": "45a140e587f3d32d8d424ed940dffb61e1739047",
              "versionType": "git"
            },
            {
              "lessThan": "028cf780743eea79abffa7206b9dcfc080ad3546",
              "status": "affected",
              "version": "45a140e587f3d32d8d424ed940dffb61e1739047",
              "versionType": "git"
            },
            {
              "lessThan": "c78b0dc6fb7fb389d674e491fd376388cdfb1d53",
              "status": "affected",
              "version": "45a140e587f3d32d8d424ed940dffb61e1739047",
              "versionType": "git"
            },
            {
              "lessThan": "6f72a3977ba9d0e5491a5c01315204272e7f9c44",
              "status": "affected",
              "version": "45a140e587f3d32d8d424ed940dffb61e1739047",
              "versionType": "git"
            },
            {
              "lessThan": "94d2643df1e70a4c310ebb5e2c493eec33df1a06",
              "status": "affected",
              "version": "45a140e587f3d32d8d424ed940dffb61e1739047",
              "versionType": "git"
            },
            {
              "lessThan": "af1b57cc39beca203559576b3046094fc9e5eb32",
              "status": "affected",
              "version": "45a140e587f3d32d8d424ed940dffb61e1739047",
              "versionType": "git"
            },
            {
              "lessThan": "4abc99652812a2ddf932f137515d5c5a04723538",
              "status": "affected",
              "version": "45a140e587f3d32d8d424ed940dffb61e1739047",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/kernfs/dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.14"
            },
            {
              "lessThan": "3.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.332",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.298",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.264",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.223",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.332",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.298",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.264",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.223",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.153",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.77",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.7",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkernfs: fix use-after-free in __kernfs_remove\n\nSyzkaller managed to trigger concurrent calls to\nkernfs_remove_by_name_ns() for the same file resulting in\na KASAN detected use-after-free. The race occurs when the root\nnode is freed during kernfs_drain().\n\nTo prevent this acquire an additional reference for the root\nof the tree that is removed before calling __kernfs_remove().\n\nFound by syzkaller with the following reproducer (slab_nomerge is\nrequired):\n\nsyz_mount_image$ext4(0x0, \u0026(0x7f0000000100)=\u0027./file0\\x00\u0027, 0x100000, 0x0, 0x0, 0x0, 0x0)\nr0 = openat(0xffffffffffffff9c, \u0026(0x7f0000000080)=\u0027/proc/self/exe\\x00\u0027, 0x0, 0x0)\nclose(r0)\npipe2(\u0026(0x7f0000000140)={0xffffffffffffffff, \u003cr1=\u003e0xffffffffffffffff}, 0x800)\nmount$9p_fd(0x0, \u0026(0x7f0000000040)=\u0027./file0\\x00\u0027, \u0026(0x7f00000000c0), 0x408, \u0026(0x7f0000000280)={\u0027trans=fd,\u0027, {\u0027rfdno\u0027, 0x3d, r0}, 0x2c, {\u0027wfdno\u0027, 0x3d, r1}, 0x2c, {[{@cache_loose}, {@mmap}, {@loose}, {@loose}, {@mmap}], [{@mask={\u0027mask\u0027, 0x3d, \u0027^MAY_EXEC\u0027}}, {@fsmagic={\u0027fsmagic\u0027, 0x3d, 0x10001}}, {@dont_hash}]}})\n\nSample report:\n\n==================================================================\nBUG: KASAN: use-after-free in kernfs_type include/linux/kernfs.h:335 [inline]\nBUG: KASAN: use-after-free in kernfs_leftmost_descendant fs/kernfs/dir.c:1261 [inline]\nBUG: KASAN: use-after-free in __kernfs_remove.part.0+0x843/0x960 fs/kernfs/dir.c:1369\nRead of size 2 at addr ffff8880088807f0 by task syz-executor.2/857\n\nCPU: 0 PID: 857 Comm: syz-executor.2 Not tainted 6.0.0-rc3-00363-g7726d4c3e60b #5\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x6e/0x91 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:317 [inline]\n print_report.cold+0x5e/0x5e5 mm/kasan/report.c:433\n kasan_report+0xa3/0x130 mm/kasan/report.c:495\n kernfs_type include/linux/kernfs.h:335 [inline]\n kernfs_leftmost_descendant fs/kernfs/dir.c:1261 [inline]\n __kernfs_remove.part.0+0x843/0x960 fs/kernfs/dir.c:1369\n __kernfs_remove fs/kernfs/dir.c:1356 [inline]\n kernfs_remove_by_name_ns+0x108/0x190 fs/kernfs/dir.c:1589\n sysfs_slab_add+0x133/0x1e0 mm/slub.c:5943\n __kmem_cache_create+0x3e0/0x550 mm/slub.c:4899\n create_cache mm/slab_common.c:229 [inline]\n kmem_cache_create_usercopy+0x167/0x2a0 mm/slab_common.c:335\n p9_client_create+0xd4d/0x1190 net/9p/client.c:993\n v9fs_session_init+0x1e6/0x13c0 fs/9p/v9fs.c:408\n v9fs_mount+0xb9/0xbd0 fs/9p/vfs_super.c:126\n legacy_get_tree+0xf1/0x200 fs/fs_context.c:610\n vfs_get_tree+0x85/0x2e0 fs/super.c:1530\n do_new_mount fs/namespace.c:3040 [inline]\n path_mount+0x675/0x1d00 fs/namespace.c:3370\n do_mount fs/namespace.c:3383 [inline]\n __do_sys_mount fs/namespace.c:3591 [inline]\n __se_sys_mount fs/namespace.c:3568 [inline]\n __x64_sys_mount+0x282/0x300 fs/namespace.c:3568\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x7f725f983aed\nCode: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f725f0f7028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5\nRAX: ffffffffffffffda RBX: 00007f725faa3f80 RCX: 00007f725f983aed\nRDX: 00000000200000c0 RSI: 0000000020000040 RDI: 0000000000000000\nRBP: 00007f725f9f419c R08: 0000000020000280 R09: 0000000000000000\nR10: 0000000000000408 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000000006 R14: 00007f725faa3f80 R15: 00007f725f0d7000\n \u003c/TASK\u003e\n\nAllocated by task 855:\n kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38\n kasan_set_track mm/kasan/common.c:45 [inline]\n set_alloc_info mm/kasan/common.c:437 [inline]\n __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:470\n kasan_slab_alloc include/linux/kasan.h:224 [inline]\n slab_post_alloc_hook mm/slab.h:7\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached through local paths into kernfs_remove_by_name_ns (e.g. mount\u21929p\u2192kmem_cache_create\u2192sysfs_slab_add\u2192sysfs_remove_link, or other local sysfs/cgroup teardown), not via remote packet/protocol processing.\nAC:L - The bug is a race between concurrent kernfs_remove_by_name_ns() callers on the same node; an attacker who drives both sides (e.g. concurrent mounts/teardowns) controls the race, and kernfs_drain() intentionally drops kernfs_rwsem so concurrent removers can interleave.\nPR:L - Although the syzkaller 9p trigger needs real CAP_SYS_ADMIN (9p lacks FS_USERNS_MOUNT), the vulnerable API is also used by unprivileged-reachable callers such as cgroup file removal in delegated cgroup2 subtrees and userns-reachable net/sysfs teardown; when uncertain, the higher-severity PR:L applies.\nUI:N - The attacker triggers the concurrent remove paths themselves (mounts, cgroup rmdir, sysfs-affecting netlink ops); no separate victim action is required.\nS:U - The UAF corrupts host-kernel kernfs_node slab state within the same OS security authority; this is local privilege-escalation class impact, not a VM escape or IOMMU/sandbox boundary cross.\nC:H - KASAN shows a use-after-free read of a freed kernfs_node (128-byte slab object); per guidance a UAF enables heap reuse/spray and arbitrary kernel memory disclosure.\nI:H - The same freed kernfs_node can be reclaimed and corrupted to obtain arbitrary write / control-flow hijack primitives, which is Integrity High for use-after-free.\nA:H - The UAF produces KASAN-detected slab-use-after-free and kernel oops/panic even when not fully exploited, so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:58:46.857Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4dfd6a477a1525773469feaf3c514b2c0fef76b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/02eb35131050735332658029082f61515b7dfe38"
        },
        {
          "url": "https://git.kernel.org/stable/c/028cf780743eea79abffa7206b9dcfc080ad3546"
        },
        {
          "url": "https://git.kernel.org/stable/c/c78b0dc6fb7fb389d674e491fd376388cdfb1d53"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f72a3977ba9d0e5491a5c01315204272e7f9c44"
        },
        {
          "url": "https://git.kernel.org/stable/c/94d2643df1e70a4c310ebb5e2c493eec33df1a06"
        },
        {
          "url": "https://git.kernel.org/stable/c/af1b57cc39beca203559576b3046094fc9e5eb32"
        },
        {
          "url": "https://git.kernel.org/stable/c/4abc99652812a2ddf932f137515d5c5a04723538"
        }
      ],
      "title": "kernfs: fix use-after-free in __kernfs_remove",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50432",
    "datePublished": "2025-10-01T11:42:10.573Z",
    "dateReserved": "2025-09-17T14:53:07.009Z",
    "dateUpdated": "2026-08-05T08:58:46.857Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50432",
      "date": "2026-09-16",
      "epss": "0.0016",
      "percentile": "0.05571"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50432\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-01T12:15:34.977\",\"lastModified\":\"2026-08-04T10:18:16.603\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nkernfs: fix use-after-free in __kernfs_remove\\n\\nSyzkaller managed to trigger concurrent calls to\\nkernfs_remove_by_name_ns() for the same file resulting in\\na KASAN detected use-after-free. The race occurs when the root\\nnode is freed during kernfs_drain().\\n\\nTo prevent this acquire an additional reference for the root\\nof the tree that is removed before calling __kernfs_remove().\\n\\nFound by syzkaller with the following reproducer (slab_nomerge is\\nrequired):\\n\\nsyz_mount_image$ext4(0x0, \u0026(0x7f0000000100)=\u0027./file0\\\\x00\u0027, 0x100000, 0x0, 0x0, 0x0, 0x0)\\nr0 = openat(0xffffffffffffff9c, \u0026(0x7f0000000080)=\u0027/proc/self/exe\\\\x00\u0027, 0x0, 0x0)\\nclose(r0)\\npipe2(\u0026(0x7f0000000140)={0xffffffffffffffff, \u003cr1=\u003e0xffffffffffffffff}, 0x800)\\nmount$9p_fd(0x0, \u0026(0x7f0000000040)=\u0027./file0\\\\x00\u0027, \u0026(0x7f00000000c0), 0x408, \u0026(0x7f0000000280)={\u0027trans=fd,\u0027, {\u0027rfdno\u0027, 0x3d, r0}, 0x2c, {\u0027wfdno\u0027, 0x3d, r1}, 0x2c, {[{@cache_loose}, {@mmap}, {@loose}, {@loose}, {@mmap}], [{@mask={\u0027mask\u0027, 0x3d, \u0027^MAY_EXEC\u0027}}, {@fsmagic={\u0027fsmagic\u0027, 0x3d, 0x10001}}, {@dont_hash}]}})\\n\\nSample report:\\n\\n==================================================================\\nBUG: KASAN: use-after-free in kernfs_type include/linux/kernfs.h:335 [inline]\\nBUG: KASAN: use-after-free in kernfs_leftmost_descendant fs/kernfs/dir.c:1261 [inline]\\nBUG: KASAN: use-after-free in __kernfs_remove.part.0+0x843/0x960 fs/kernfs/dir.c:1369\\nRead of size 2 at addr ffff8880088807f0 by task syz-executor.2/857\\n\\nCPU: 0 PID: 857 Comm: syz-executor.2 Not tainted 6.0.0-rc3-00363-g7726d4c3e60b #5\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\\nCall Trace:\\n \u003cTASK\u003e\\n __dump_stack lib/dump_stack.c:88 [inline]\\n dump_stack_lvl+0x6e/0x91 lib/dump_stack.c:106\\n print_address_description mm/kasan/report.c:317 [inline]\\n print_report.cold+0x5e/0x5e5 mm/kasan/report.c:433\\n kasan_report+0xa3/0x130 mm/kasan/report.c:495\\n kernfs_type include/linux/kernfs.h:335 [inline]\\n kernfs_leftmost_descendant fs/kernfs/dir.c:1261 [inline]\\n __kernfs_remove.part.0+0x843/0x960 fs/kernfs/dir.c:1369\\n __kernfs_remove fs/kernfs/dir.c:1356 [inline]\\n kernfs_remove_by_name_ns+0x108/0x190 fs/kernfs/dir.c:1589\\n sysfs_slab_add+0x133/0x1e0 mm/slub.c:5943\\n __kmem_cache_create+0x3e0/0x550 mm/slub.c:4899\\n create_cache mm/slab_common.c:229 [inline]\\n kmem_cache_create_usercopy+0x167/0x2a0 mm/slab_common.c:335\\n p9_client_create+0xd4d/0x1190 net/9p/client.c:993\\n v9fs_session_init+0x1e6/0x13c0 fs/9p/v9fs.c:408\\n v9fs_mount+0xb9/0xbd0 fs/9p/vfs_super.c:126\\n legacy_get_tree+0xf1/0x200 fs/fs_context.c:610\\n vfs_get_tree+0x85/0x2e0 fs/super.c:1530\\n do_new_mount fs/namespace.c:3040 [inline]\\n path_mount+0x675/0x1d00 fs/namespace.c:3370\\n do_mount fs/namespace.c:3383 [inline]\\n __do_sys_mount fs/namespace.c:3591 [inline]\\n __se_sys_mount fs/namespace.c:3568 [inline]\\n __x64_sys_mount+0x282/0x300 fs/namespace.c:3568\\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\\n do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80\\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\\nRIP: 0033:0x7f725f983aed\\nCode: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\\nRSP: 002b:00007f725f0f7028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5\\nRAX: ffffffffffffffda RBX: 00007f725faa3f80 RCX: 00007f725f983aed\\nRDX: 00000000200000c0 RSI: 0000000020000040 RDI: 0000000000000000\\nRBP: 00007f725f9f419c R08: 0000000020000280 R09: 0000000000000000\\nR10: 0000000000000408 R11: 0000000000000246 R12: 0000000000000000\\nR13: 0000000000000006 R14: 00007f725faa3f80 R15: 00007f725f0d7000\\n \u003c/TASK\u003e\\n\\nAllocated by task 855:\\n kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38\\n kasan_set_track mm/kasan/common.c:45 [inline]\\n set_alloc_info mm/kasan/common.c:437 [inline]\\n __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:470\\n kasan_slab_alloc include/linux/kasan.h:224 [inline]\\n slab_post_alloc_hook mm/slab.h:7\\n---truncated---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/kernfs/dir.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"45a140e587f3d32d8d424ed940dffb61e1739047\",\"lessThan\":\"4dfd6a477a1525773469feaf3c514b2c0fef76b5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"45a140e587f3d32d8d424ed940dffb61e1739047\",\"lessThan\":\"02eb35131050735332658029082f61515b7dfe38\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"45a140e587f3d32d8d424ed940dffb61e1739047\",\"lessThan\":\"028cf780743eea79abffa7206b9dcfc080ad3546\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"45a140e587f3d32d8d424ed940dffb61e1739047\",\"lessThan\":\"c78b0dc6fb7fb389d674e491fd376388cdfb1d53\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"45a140e587f3d32d8d424ed940dffb61e1739047\",\"lessThan\":\"6f72a3977ba9d0e5491a5c01315204272e7f9c44\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"45a140e587f3d32d8d424ed940dffb61e1739047\",\"lessThan\":\"94d2643df1e70a4c310ebb5e2c493eec33df1a06\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"45a140e587f3d32d8d424ed940dffb61e1739047\",\"lessThan\":\"af1b57cc39beca203559576b3046094fc9e5eb32\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"45a140e587f3d32d8d424ed940dffb61e1739047\",\"lessThan\":\"4abc99652812a2ddf932f137515d5c5a04723538\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/kernfs/dir.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.9.332\",\"lessThanOrEqual\":\"4.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.298\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.264\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.223\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.153\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.77\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0.7\",\"lessThanOrEqual\":\"6.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.14\",\"versionEndExcluding\":\"4.9.332\",\"matchCriteriaId\":\"37026F01-AFEE-47AC-B31E-05AD5F5200BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10\",\"versionEndExcluding\":\"4.14.298\",\"matchCriteriaId\":\"7140B9A2-EB63-497C-96B1-68A96CD99051\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.264\",\"matchCriteriaId\":\"8AE23A9F-BF98-4055-AA49-02118B96226D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.223\",\"matchCriteriaId\":\"7FE3F72A-5992-4ABB-A961-F834281060A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.153\",\"matchCriteriaId\":\"62052E35-0E91-4164-BB92-83270CEA0113\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.77\",\"matchCriteriaId\":\"756161DE-EFE3-4008-964A-DFE360B188B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.0.7\",\"matchCriteriaId\":\"65D387F0-209C-4EAD-98BA-C4B430A840C9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/028cf780743eea79abffa7206b9dcfc080ad3546\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/02eb35131050735332658029082f61515b7dfe38\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4abc99652812a2ddf932f137515d5c5a04723538\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4dfd6a477a1525773469feaf3c514b2c0fef76b5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6f72a3977ba9d0e5491a5c01315204272e7f9c44\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/94d2643df1e70a4c310ebb5e2c493eec33df1a06\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/af1b57cc39beca203559576b3046094fc9e5eb32\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c78b0dc6fb7fb389d674e491fd376388cdfb1d53\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:58:57+00:00",
      "cve": "CVE-2022-50432",
      "id": "CVE-2022-50432",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: kernfs: fix use-after-free in __kernfs_remove",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50432.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-31T01:23:45Z",
      "cve": "CVE-2022-50432",
      "id": "CVE-2022-50432",
      "initial_release_date": "2025-10-01T23:32:48Z",
      "product_status:known_affected": "492",
      "product_status:known_not_affected": "176",
      "product_status:recommended": "330",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50432",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50432.json",
      "version": "57"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.