GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50219 (GCVE-0-2022-50219)

Vulnerability from cvelistv5 – Published: 2025-06-18 11:03 – Updated: 2026-08-05 08:57
VLAI
Title
bpf: Fix KASAN use-after-free Read in compute_effective_progs
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix KASAN use-after-free Read in compute_effective_progs Syzbot found a Use After Free bug in compute_effective_progs(). The reproducer creates a number of BPF links, and causes a fault injected alloc to fail, while calling bpf_link_detach on them. Link detach triggers the link to be freed by bpf_link_free(), which calls __cgroup_bpf_detach() and update_effective_progs(). If the memory allocation in this function fails, the function restores the pointer to the bpf_cgroup_link on the cgroup list, but the memory gets freed just after it returns. After this, every subsequent call to update_effective_progs() causes this already deallocated pointer to be dereferenced in prog_list_length(), and triggers KASAN UAF error. To fix this issue don't preserve the pointer to the prog or link in the list, but remove it and replace it with a dummy prog without shrinking the table. The subsequent call to __cgroup_bpf_detach() or __cgroup_bpf_detach() will correct it.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: af6eea57437a830293eab56246b6025cc7d46ee7 , < 3527e3cbb84d8868c4d4e91ba55915f96d39ec3d (git)
Affected: af6eea57437a830293eab56246b6025cc7d46ee7 , < 1f8ca9c40e6222ce431e9ba5dae3cccce8ef9443 (git)
Affected: af6eea57437a830293eab56246b6025cc7d46ee7 , < 6336388715afa419cc97d0255bda3bba1b96b7ca (git)
Affected: af6eea57437a830293eab56246b6025cc7d46ee7 , < be001f9da71eaa3b61e186fb88bde3279728bdca (git)
Affected: af6eea57437a830293eab56246b6025cc7d46ee7 , < 4c46091ee985ae84c60c5e95055d779fcd291d87 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.7
Unaffected: 0 , < 5.7 (semver)
Unaffected: 5.10.138 , ≤ 5.10.* (semver)
Unaffected: 5.15.61 , ≤ 5.15.* (semver)
Unaffected: 5.18.18 , ≤ 5.18.* (semver)
Unaffected: 5.19.2 , ≤ 5.19.* (semver)
Unaffected: 6.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/cgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3527e3cbb84d8868c4d4e91ba55915f96d39ec3d",
              "status": "affected",
              "version": "af6eea57437a830293eab56246b6025cc7d46ee7",
              "versionType": "git"
            },
            {
              "lessThan": "1f8ca9c40e6222ce431e9ba5dae3cccce8ef9443",
              "status": "affected",
              "version": "af6eea57437a830293eab56246b6025cc7d46ee7",
              "versionType": "git"
            },
            {
              "lessThan": "6336388715afa419cc97d0255bda3bba1b96b7ca",
              "status": "affected",
              "version": "af6eea57437a830293eab56246b6025cc7d46ee7",
              "versionType": "git"
            },
            {
              "lessThan": "be001f9da71eaa3b61e186fb88bde3279728bdca",
              "status": "affected",
              "version": "af6eea57437a830293eab56246b6025cc7d46ee7",
              "versionType": "git"
            },
            {
              "lessThan": "4c46091ee985ae84c60c5e95055d779fcd291d87",
              "status": "affected",
              "version": "af6eea57437a830293eab56246b6025cc7d46ee7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/cgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.138",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.138",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.61",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.18",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.2",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix KASAN use-after-free Read in compute_effective_progs\n\nSyzbot found a Use After Free bug in compute_effective_progs().\nThe reproducer creates a number of BPF links, and causes a fault\ninjected alloc to fail, while calling bpf_link_detach on them.\nLink detach triggers the link to be freed by bpf_link_free(),\nwhich calls __cgroup_bpf_detach() and update_effective_progs().\nIf the memory allocation in this function fails, the function restores\nthe pointer to the bpf_cgroup_link on the cgroup list, but the memory\ngets freed just after it returns. After this, every subsequent call to\nupdate_effective_progs() causes this already deallocated pointer to be\ndereferenced in prog_list_length(), and triggers KASAN UAF error.\n\nTo fix this issue don\u0027t preserve the pointer to the prog or link in the\nlist, but remove it and replace it with a dummy prog without shrinking\nthe table. The subsequent call to __cgroup_bpf_detach() or\n__cgroup_bpf_detach() will correct it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via the bpf(2) syscall path for cgroup BPF link attach/detach (BPF_LINK_CREATE / BPF_LINK_DETACH or closing the link FD), which requires local process execution and is not reachable from the network stack.\nAC:L - The attacker fully controls link creation and detach timing, and can induce the required GFP_KERNEL allocation failure in compute_effective_progs() through memory pressure and large cgroup/program hierarchies; once the dangling pointer is planted, subsequent effective-prog updates reliably hit the UAF.\nPR:L - Triggering requires attaching a cgroup BPF link (CAP_NET_ADMIN via capable(), and CAP_BPF for most cgroup prog types other than CGROUP_SKB which can be loaded unprivileged), which is commonly available to container/admin-adjacent local users and is scored as Low rather than full root, consistent with similar cgroup BPF CVEs.\nUI:N - The attacker triggers the vulnerability entirely through their own bpf(2) and FD close operations; no separate victim action is required.\nS:U - Exploitation affects the host kernel\u0027s own memory and privilege boundaries (local privilege escalation within the same kernel), with no VM/IOMMU/sandbox authority boundary crossed.\nC:H - This is a use-after-free read of a freed bpf_cgroup_link (pl-\u003elink-\u003elink.prog); after heap reuse the attacker can obtain arbitrary kernel reads and install attacker-controlled pointers into the effective prog array.\nI:H - UAF of the link object enables heap spraying so a forged bpf_cgroup_link/prog pointer is written into cgroup effective program arrays, yielding arbitrary kernel write/control-flow hijack when those hooks run.\nA:H - The dangling link pointer is dereferenced on later update_effective_progs()/compute_effective_progs() calls and causes kernel oops/KASAN use-after-free crashes, so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:57:45.064Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3527e3cbb84d8868c4d4e91ba55915f96d39ec3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f8ca9c40e6222ce431e9ba5dae3cccce8ef9443"
        },
        {
          "url": "https://git.kernel.org/stable/c/6336388715afa419cc97d0255bda3bba1b96b7ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/be001f9da71eaa3b61e186fb88bde3279728bdca"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c46091ee985ae84c60c5e95055d779fcd291d87"
        }
      ],
      "title": "bpf: Fix KASAN use-after-free Read in compute_effective_progs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50219",
    "datePublished": "2025-06-18T11:03:54.711Z",
    "dateReserved": "2025-06-18T10:57:27.430Z",
    "dateUpdated": "2026-08-05T08:57:45.064Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50219",
      "date": "2026-09-15",
      "epss": "0.00213",
      "percentile": "0.11706"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50219\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-06-18T11:15:52.863\",\"lastModified\":\"2026-08-04T10:18:07.553\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Fix KASAN use-after-free Read in compute_effective_progs\\n\\nSyzbot found a Use After Free bug in compute_effective_progs().\\nThe reproducer creates a number of BPF links, and causes a fault\\ninjected alloc to fail, while calling bpf_link_detach on them.\\nLink detach triggers the link to be freed by bpf_link_free(),\\nwhich calls __cgroup_bpf_detach() and update_effective_progs().\\nIf the memory allocation in this function fails, the function restores\\nthe pointer to the bpf_cgroup_link on the cgroup list, but the memory\\ngets freed just after it returns. After this, every subsequent call to\\nupdate_effective_progs() causes this already deallocated pointer to be\\ndereferenced in prog_list_length(), and triggers KASAN UAF error.\\n\\nTo fix this issue don\u0027t preserve the pointer to the prog or link in the\\nlist, but remove it and replace it with a dummy prog without shrinking\\nthe table. The subsequent call to __cgroup_bpf_detach() or\\n__cgroup_bpf_detach() will correct it.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Correcci\u00f3n de la lectura de Use-After-Free de KASAN en compute_effective_progs Syzbot encontr\u00f3 un error de Use-After-Free en compute_effective_progs(). El reproductor crea varios enlaces BPF y provoca que falle una asignaci\u00f3n inyectada por error, al llamar a bpf_link_detach en ellos. La separaci\u00f3n del enlace activa la liberaci\u00f3n del enlace por bpf_link_free(), que llama a __cgroup_bpf_detach() y update_effective_progs(). Si la asignaci\u00f3n de memoria en esta funci\u00f3n falla, la funci\u00f3n restaura el puntero a bpf_cgroup_link en la lista cgroup, pero la memoria se libera justo despu\u00e9s de que regrese. Despu\u00e9s de esto, cada llamada posterior a update_effective_progs() hace que este puntero ya desasignado se desreferencia en prog_list_length() y activa el error UAF de KASAN. Para solucionar este problema, no conserve el puntero al programa ni al enlace en la lista, sino elim\u00ednelo y reempl\u00e1celo con un programa ficticio sin reducir la tabla. La llamada posterior a __cgroup_bpf_detach() o __cgroup_bpf_detach() lo corregir\u00e1. \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/bpf/cgroup.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"af6eea57437a830293eab56246b6025cc7d46ee7\",\"lessThan\":\"3527e3cbb84d8868c4d4e91ba55915f96d39ec3d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"af6eea57437a830293eab56246b6025cc7d46ee7\",\"lessThan\":\"1f8ca9c40e6222ce431e9ba5dae3cccce8ef9443\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"af6eea57437a830293eab56246b6025cc7d46ee7\",\"lessThan\":\"6336388715afa419cc97d0255bda3bba1b96b7ca\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"af6eea57437a830293eab56246b6025cc7d46ee7\",\"lessThan\":\"be001f9da71eaa3b61e186fb88bde3279728bdca\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"af6eea57437a830293eab56246b6025cc7d46ee7\",\"lessThan\":\"4c46091ee985ae84c60c5e95055d779fcd291d87\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/bpf/cgroup.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.138\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.61\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18.18\",\"lessThanOrEqual\":\"5.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19.2\",\"lessThanOrEqual\":\"5.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.7\",\"versionEndExcluding\":\"5.10.138\",\"matchCriteriaId\":\"E036C6FE-698D-47B5-997F-8EF2A4EB00D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.61\",\"matchCriteriaId\":\"51861563-7F40-460F-82CD-2D3FBDAD6618\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.18.18\",\"matchCriteriaId\":\"5B42E453-8837-49D0-A5EF-03F818A6DC11\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.19\",\"versionEndExcluding\":\"5.19.2\",\"matchCriteriaId\":\"A1A2A5A5-4598-4D7E-BA07-4660398D6C8F\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1f8ca9c40e6222ce431e9ba5dae3cccce8ef9443\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3527e3cbb84d8868c4d4e91ba55915f96d39ec3d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4c46091ee985ae84c60c5e95055d779fcd291d87\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6336388715afa419cc97d0255bda3bba1b96b7ca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/be001f9da71eaa3b61e186fb88bde3279728bdca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:40:00+00:00",
      "cve": "CVE-2022-50219",
      "id": "CVE-2022-50219",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "321",
      "product_status:known_affected": "38",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Fix KASAN use-after-free Read in compute_effective_progs",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50219.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T02:01:12Z",
      "cve": "CVE-2022-50219",
      "id": "CVE-2022-50219",
      "initial_release_date": "2025-06-19T03:38:48Z",
      "product_status:known_affected": "104",
      "product_status:known_not_affected": "405",
      "product_status:recommended": "47",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50219",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50219.json",
      "version": "12"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.