CVE-2022-50022
drivers:md:fix a potential use-after-free bug
Reported by linux · Published June 18, 2025
In the Linux kernel, the following vulnerability has been resolved: drivers:md:fix a potential use-after-free bug In line 2884, "raid5_release_stripe(sh);" drops the reference to sh and may cause sh to be released. However, sh is subsequently used in lines 2886 "if (sh->batch_head && sh != sh->batch_head)". This may result in an use-after-free bug. It can be fixed by moving "raid5_release_stripe(sh);" to the bottom of the function.
EPSS 0.26% · 17.5th percentile
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| kernel | Amazon Linux | 4.14.291-218.527.amzn2 |
| kernel-devel | Amazon Linux | 4.14.291-218.527.amzn2 |
| kernel-tools | Amazon Linux | 4.14.291-218.527.amzn2 |
| kernel-livepatch-4.14.291-218.527 | Amazon Linux | 1.0-0.amzn2 |
| Linux | Linux | eb3a4f73f43f839df981dda5859e8e075067a360, e5b3dd2d92c4511e81f6e4ec9c5bb7ad25e03d13, 5d8325fd15892c8ab1146edc1d7ed8463de39636, 09cf99bace7789d91caa8d10fbcfc8b2fb35857f |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | 59fc630b8b5f9f21c8ce3ba153341c107dce1b0c, 59fc630b8b5f9f21c8ce3ba153341c107dce1b0c, 59fc630b8b5f9f21c8ce3ba153341c107dce1b0c |
| Linux | Linux | 4.1, 0, 4.9.326 |
| amazon:2 | kernel | 0 |
| amazon:2 | kernel-devel | 0 |
| amazon:2 | kernel-tools | 0 |
| amazon:2 | kernel-livepatch-4.14.291-218.527 | 0 |
| Linux | Linux | 59fc630b8b5f9f21c8ce3ba153341c107dce1b0c, 0, 4.9.326 |
| amazon:2 | kernel-headers | 0 |
| amazon:2 | perf | 0 |
| amazon:2 | kernel-tools-devel | 0 |
| linux | linux_kernel | 4.1, 4.1, 4.1 |
| amazon:2 | python-perf | 0 |
Timeline
- Jun 18, 2025 CVE Published
- Jun 29, 2025 EPSS Score (29 in total, the first dated here)
- May 23, 2026 Coalition ESS Score
- Jun 2, 2026 Security Advisory (255 in total, the first dated here)
- Aug 8, 2026 Distribution Patch (244 in total, the first dated here)
- Oct 13, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2022-50022
vulnetix vdb fixes CVE-2022-50022Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2022-50022/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart