CVE-2022-50517 (GCVE-0-2022-50517)

Vulnerability from cvelistv5 – Published: 2025-10-07 15:19 – Updated: 2026-08-05 08:59
VLAI
Title
mm/huge_memory: do not clobber swp_entry_t during THP split
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: do not clobber swp_entry_t during THP split The following has been observed when running stressng mmap since commit b653db77350c ("mm: Clear page->private when splitting or migrating a page") watchdog: BUG: soft lockup - CPU#75 stuck for 26s! [stress-ng:9546] CPU: 75 PID: 9546 Comm: stress-ng Tainted: G E 6.0.0-revert-b653db77-fix+ #29 0357d79b60fb09775f678e4f3f64ef0579ad1374 Hardware name: SGI.COM C2112-4GP3/X10DRT-P-Series, BIOS 2.0a 05/09/2016 RIP: 0010:xas_descend+0x28/0x80 Code: cc cc 0f b6 0e 48 8b 57 08 48 d3 ea 83 e2 3f 89 d0 48 83 c0 04 48 8b 44 c6 08 48 89 77 18 48 89 c1 83 e1 03 48 83 f9 02 75 08 <48> 3d fd 00 00 00 76 08 88 57 12 c3 cc cc cc cc 48 c1 e8 02 89 c2 RSP: 0018:ffffbbf02a2236a8 EFLAGS: 00000246 RAX: ffff9cab7d6a0002 RBX: ffffe04b0af88040 RCX: 0000000000000002 RDX: 0000000000000030 RSI: ffff9cab60509b60 RDI: ffffbbf02a2236c0 RBP: 0000000000000000 R08: ffff9cab60509b60 R09: ffffbbf02a2236c0 R10: 0000000000000001 R11: ffffbbf02a223698 R12: 0000000000000000 R13: ffff9cab4e28da80 R14: 0000000000039c01 R15: ffff9cab4e28da88 FS: 00007fab89b85e40(0000) GS:ffff9cea3fcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fab84e00000 CR3: 00000040b73a4003 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> xas_load+0x3a/0x50 __filemap_get_folio+0x80/0x370 ? put_swap_page+0x163/0x360 pagecache_get_page+0x13/0x90 __try_to_reclaim_swap+0x50/0x190 scan_swap_map_slots+0x31e/0x670 get_swap_pages+0x226/0x3c0 folio_alloc_swap+0x1cc/0x240 add_to_swap+0x14/0x70 shrink_page_list+0x968/0xbc0 reclaim_page_list+0x70/0xf0 reclaim_pages+0xdd/0x120 madvise_cold_or_pageout_pte_range+0x814/0xf30 walk_pgd_range+0x637/0xa30 __walk_page_range+0x142/0x170 walk_page_range+0x146/0x170 madvise_pageout+0xb7/0x280 ? asm_common_interrupt+0x22/0x40 madvise_vma_behavior+0x3b7/0xac0 ? find_vma+0x4a/0x70 ? find_vma+0x64/0x70 ? madvise_vma_anon_name+0x40/0x40 madvise_walk_vmas+0xa6/0x130 do_madvise+0x2f4/0x360 __x64_sys_madvise+0x26/0x30 do_syscall_64+0x5b/0x80 ? do_syscall_64+0x67/0x80 ? syscall_exit_to_user_mode+0x17/0x40 ? do_syscall_64+0x67/0x80 ? syscall_exit_to_user_mode+0x17/0x40 ? do_syscall_64+0x67/0x80 ? do_syscall_64+0x67/0x80 ? common_interrupt+0x8b/0xa0 entry_SYSCALL_64_after_hwframe+0x63/0xcd The problem can be reproduced with the mmtests config config-workload-stressng-mmap. It does not always happen and when it triggers is variable but it has happened on multiple machines. The intent of commit b653db77350c patch was to avoid the case where PG_private is clear but folio->private is not-NULL. However, THP tail pages uses page->private for "swp_entry_t if folio_test_swapcache()" as stated in the documentation for struct folio. This patch only clobbers page->private for tail pages if the head page was not in swapcache and warns once if page->private had an unexpected value.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b653db77350c7307a513b81856fe53e94cf42446 , < 8cace0eeb03d6043827faa6cf6c9067a9f05cd9f (git)
Affected: b653db77350c7307a513b81856fe53e94cf42446 , < 71e2d666ef85d51834d658830f823560c402b8b6 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.19
Unaffected: 0 , < 5.19 (semver)
Unaffected: 6.0.7 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/huge_memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8cace0eeb03d6043827faa6cf6c9067a9f05cd9f",
              "status": "affected",
              "version": "b653db77350c7307a513b81856fe53e94cf42446",
              "versionType": "git"
            },
            {
              "lessThan": "71e2d666ef85d51834d658830f823560c402b8b6",
              "status": "affected",
              "version": "b653db77350c7307a513b81856fe53e94cf42446",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/huge_memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.7",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: do not clobber swp_entry_t during THP split\n\nThe following has been observed when running stressng mmap since commit\nb653db77350c (\"mm: Clear page-\u003eprivate when splitting or migrating a page\")\n\n   watchdog: BUG: soft lockup - CPU#75 stuck for 26s! [stress-ng:9546]\n   CPU: 75 PID: 9546 Comm: stress-ng Tainted: G            E      6.0.0-revert-b653db77-fix+ #29 0357d79b60fb09775f678e4f3f64ef0579ad1374\n   Hardware name: SGI.COM C2112-4GP3/X10DRT-P-Series, BIOS 2.0a 05/09/2016\n   RIP: 0010:xas_descend+0x28/0x80\n   Code: cc cc 0f b6 0e 48 8b 57 08 48 d3 ea 83 e2 3f 89 d0 48 83 c0 04 48 8b 44 c6 08 48 89 77 18 48 89 c1 83 e1 03 48 83 f9 02 75 08 \u003c48\u003e 3d fd 00 00 00 76 08 88 57 12 c3 cc cc cc cc 48 c1 e8 02 89 c2\n   RSP: 0018:ffffbbf02a2236a8 EFLAGS: 00000246\n   RAX: ffff9cab7d6a0002 RBX: ffffe04b0af88040 RCX: 0000000000000002\n   RDX: 0000000000000030 RSI: ffff9cab60509b60 RDI: ffffbbf02a2236c0\n   RBP: 0000000000000000 R08: ffff9cab60509b60 R09: ffffbbf02a2236c0\n   R10: 0000000000000001 R11: ffffbbf02a223698 R12: 0000000000000000\n   R13: ffff9cab4e28da80 R14: 0000000000039c01 R15: ffff9cab4e28da88\n   FS:  00007fab89b85e40(0000) GS:ffff9cea3fcc0000(0000) knlGS:0000000000000000\n   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n   CR2: 00007fab84e00000 CR3: 00000040b73a4003 CR4: 00000000003706e0\n   DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n   DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n   Call Trace:\n    \u003cTASK\u003e\n    xas_load+0x3a/0x50\n    __filemap_get_folio+0x80/0x370\n    ? put_swap_page+0x163/0x360\n    pagecache_get_page+0x13/0x90\n    __try_to_reclaim_swap+0x50/0x190\n    scan_swap_map_slots+0x31e/0x670\n    get_swap_pages+0x226/0x3c0\n    folio_alloc_swap+0x1cc/0x240\n    add_to_swap+0x14/0x70\n    shrink_page_list+0x968/0xbc0\n    reclaim_page_list+0x70/0xf0\n    reclaim_pages+0xdd/0x120\n    madvise_cold_or_pageout_pte_range+0x814/0xf30\n    walk_pgd_range+0x637/0xa30\n    __walk_page_range+0x142/0x170\n    walk_page_range+0x146/0x170\n    madvise_pageout+0xb7/0x280\n    ? asm_common_interrupt+0x22/0x40\n    madvise_vma_behavior+0x3b7/0xac0\n    ? find_vma+0x4a/0x70\n    ? find_vma+0x64/0x70\n    ? madvise_vma_anon_name+0x40/0x40\n    madvise_walk_vmas+0xa6/0x130\n    do_madvise+0x2f4/0x360\n    __x64_sys_madvise+0x26/0x30\n    do_syscall_64+0x5b/0x80\n    ? do_syscall_64+0x67/0x80\n    ? syscall_exit_to_user_mode+0x17/0x40\n    ? do_syscall_64+0x67/0x80\n    ? syscall_exit_to_user_mode+0x17/0x40\n    ? do_syscall_64+0x67/0x80\n    ? do_syscall_64+0x67/0x80\n    ? common_interrupt+0x8b/0xa0\n    entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nThe problem can be reproduced with the mmtests config\nconfig-workload-stressng-mmap.  It does not always happen and when it\ntriggers is variable but it has happened on multiple machines.\n\nThe intent of commit b653db77350c patch was to avoid the case where\nPG_private is clear but folio-\u003eprivate is not-NULL.  However, THP tail\npages uses page-\u003eprivate for \"swp_entry_t if folio_test_swapcache()\" as\nstated in the documentation for struct folio.  This patch only clobbers\npage-\u003eprivate for tail pages if the head page was not in swapcache and\nwarns once if page-\u003eprivate had an unexpected value."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through local memory-management paths (madvise pageout/cold, reclaim, migration) that split anonymous THPs after they are in the swap cache; it is not reachable from the network stack or remote protocols.\nAC:L - An unprivileged attacker who can allocate THPs and force reclaim/split (e.g., MADV_PAGEOUT, memory pressure, partial THP unmap) controls the triggering conditions; clobbering swp_entry_t on split is deterministic once a swapcached THP is split, and retries remove remaining timing noise.\nPR:L - Ordinary unprivileged local users can create anonymous THP mappings and invoke madvise(MADV_PAGEOUT/MADV_COLD) on their own VMAs without capabilities; only process_madvise on other tasks needs CAP_SYS_NICE.\nUI:N - Exploitation requires no victim action; the attacker performs the memory allocation and madvise/reclaim operations themselves.\nS:U - Impact stays within the host kernel\u0027s memory-management authority (local DoS / potential privilege impact on the same kernel); it is not a VM escape or other cross-authority boundary bypass.\nC:H - Zeroing tail-page swp_entry_t corrupts swap-cache bookkeeping so later delete/reclaim uses the wrong swap offset, leaving stale folio pointers in the swap xarray and enabling use-after-free / cross-process swap-data exposure.\nI:H - The same metadata corruption can remove or free the wrong swap-cache entries and swap slots, yielding heap UAF and arbitrary kernel memory-corruption primitives beyond a clean crash.\nA:H - The observed failure is a soft lockup in xas_descend during swap reclaim, and the corrupted swap-cache state can hang or crash the kernel under continued memory pressure."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:59:01.931Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8cace0eeb03d6043827faa6cf6c9067a9f05cd9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/71e2d666ef85d51834d658830f823560c402b8b6"
        }
      ],
      "title": "mm/huge_memory: do not clobber swp_entry_t during THP split",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50517",
    "datePublished": "2025-10-07T15:19:12.344Z",
    "dateReserved": "2025-10-07T15:15:38.662Z",
    "dateUpdated": "2026-08-05T08:59:01.931Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50517",
      "date": "2026-10-02",
      "epss": "0.00144",
      "percentile": "0.0313"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "mm/huge_memory.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "8cace0eeb03d6043827faa6cf6c9067a9f05cd9f",
                    "status": "affected",
                    "version": "b653db77350c7307a513b81856fe53e94cf42446",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "71e2d666ef85d51834d658830f823560c402b8b6",
                    "status": "affected",
                    "version": "b653db77350c7307a513b81856fe53e94cf42446",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "mm/huge_memory.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.19"
                  },
                  {
                    "lessThan": "5.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.0.*",
                    "status": "unaffected",
                    "version": "6.0.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4C6EA4ED-251A-4379-8E94-5B579DF1D554",
                    "versionEndExcluding": "6.0.7",
                    "versionStartIncluding": "5.19.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:-:*:*:*:*:*:*",
                    "matchCriteriaId": "9D759CCF-9E1B-41B2-81AA-CB580C5F3EEC",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "2E9C0DB0-D349-489F-A3D6-B77214E93A8A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "1A0DE3B7-0FFB-45AA-9BD6-19870CA7C6FD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "00AE778B-BAEE-49EB-9F84-003B73D7862A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "C178431E-AD82-4B3D-B70F-A273A02ABD5D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc8:*:*:*:*:*:*",
                    "matchCriteriaId": "2CF5D19C-C418-4B57-B52D-7795547F4096",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "E7E331DA-1FB0-4DEC-91AC-7DA69D461C11",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: do not clobber swp_entry_t during THP split\n\nThe following has been observed when running stressng mmap since commit\nb653db77350c (\"mm: Clear page-\u003eprivate when splitting or migrating a page\")\n\n   watchdog: BUG: soft lockup - CPU#75 stuck for 26s! [stress-ng:9546]\n   CPU: 75 PID: 9546 Comm: stress-ng Tainted: G            E      6.0.0-revert-b653db77-fix+ #29 0357d79b60fb09775f678e4f3f64ef0579ad1374\n   Hardware name: SGI.COM C2112-4GP3/X10DRT-P-Series, BIOS 2.0a 05/09/2016\n   RIP: 0010:xas_descend+0x28/0x80\n   Code: cc cc 0f b6 0e 48 8b 57 08 48 d3 ea 83 e2 3f 89 d0 48 83 c0 04 48 8b 44 c6 08 48 89 77 18 48 89 c1 83 e1 03 48 83 f9 02 75 08 \u003c48\u003e 3d fd 00 00 00 76 08 88 57 12 c3 cc cc cc cc 48 c1 e8 02 89 c2\n   RSP: 0018:ffffbbf02a2236a8 EFLAGS: 00000246\n   RAX: ffff9cab7d6a0002 RBX: ffffe04b0af88040 RCX: 0000000000000002\n   RDX: 0000000000000030 RSI: ffff9cab60509b60 RDI: ffffbbf02a2236c0\n   RBP: 0000000000000000 R08: ffff9cab60509b60 R09: ffffbbf02a2236c0\n   R10: 0000000000000001 R11: ffffbbf02a223698 R12: 0000000000000000\n   R13: ffff9cab4e28da80 R14: 0000000000039c01 R15: ffff9cab4e28da88\n   FS:  00007fab89b85e40(0000) GS:ffff9cea3fcc0000(0000) knlGS:0000000000000000\n   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n   CR2: 00007fab84e00000 CR3: 00000040b73a4003 CR4: 00000000003706e0\n   DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n   DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n   Call Trace:\n    \u003cTASK\u003e\n    xas_load+0x3a/0x50\n    __filemap_get_folio+0x80/0x370\n    ? put_swap_page+0x163/0x360\n    pagecache_get_page+0x13/0x90\n    __try_to_reclaim_swap+0x50/0x190\n    scan_swap_map_slots+0x31e/0x670\n    get_swap_pages+0x226/0x3c0\n    folio_alloc_swap+0x1cc/0x240\n    add_to_swap+0x14/0x70\n    shrink_page_list+0x968/0xbc0\n    reclaim_page_list+0x70/0xf0\n    reclaim_pages+0xdd/0x120\n    madvise_cold_or_pageout_pte_range+0x814/0xf30\n    walk_pgd_range+0x637/0xa30\n    __walk_page_range+0x142/0x170\n    walk_page_range+0x146/0x170\n    madvise_pageout+0xb7/0x280\n    ? asm_common_interrupt+0x22/0x40\n    madvise_vma_behavior+0x3b7/0xac0\n    ? find_vma+0x4a/0x70\n    ? find_vma+0x64/0x70\n    ? madvise_vma_anon_name+0x40/0x40\n    madvise_walk_vmas+0xa6/0x130\n    do_madvise+0x2f4/0x360\n    __x64_sys_madvise+0x26/0x30\n    do_syscall_64+0x5b/0x80\n    ? do_syscall_64+0x67/0x80\n    ? syscall_exit_to_user_mode+0x17/0x40\n    ? do_syscall_64+0x67/0x80\n    ? syscall_exit_to_user_mode+0x17/0x40\n    ? do_syscall_64+0x67/0x80\n    ? do_syscall_64+0x67/0x80\n    ? common_interrupt+0x8b/0xa0\n    entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nThe problem can be reproduced with the mmtests config\nconfig-workload-stressng-mmap.  It does not always happen and when it\ntriggers is variable but it has happened on multiple machines.\n\nThe intent of commit b653db77350c patch was to avoid the case where\nPG_private is clear but folio-\u003eprivate is not-NULL.  However, THP tail\npages uses page-\u003eprivate for \"swp_entry_t if folio_test_swapcache()\" as\nstated in the documentation for struct folio.  This patch only clobbers\npage-\u003eprivate for tail pages if the head page was not in swapcache and\nwarns once if page-\u003eprivate had an unexpected value."
          }
        ],
        "id": "CVE-2022-50517",
        "lastModified": "2026-08-04T10:18:18.670",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-10-07T16:15:35.367",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/71e2d666ef85d51834d658830f823560c402b8b6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8cace0eeb03d6043827faa6cf6c9067a9f05cd9f"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:38:03+00:00",
      "cve": "CVE-2022-50517",
      "id": "CVE-2022-50517",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm/huge_memory: do not clobber swp_entry_t during THP split",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50517.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T02:20:26Z",
      "cve": "CVE-2022-50517",
      "id": "CVE-2022-50517",
      "initial_release_date": "2025-10-08T23:39:27Z",
      "product_status:known_not_affected": "523",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50517",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50517.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.