{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2022-50260 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2022-50260 is a medium-severity vulnerability in Linux kernel, published on 15 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-50260 and fix it if it is affected.\n\nWhat it is: CVE-2022-50260 is a medium-severity vulnerability in Linux kernel, published on 15 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2022-50260 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-50260/ (Markdown: https://insights.sbomify.com/CVE-2022-50260/index.md)","id":"CVE-2022-50260","markdown":"https://insights.sbomify.com/CVE-2022-50260/index.md","name":"CVE-2022-50260","record":{"aliases":["AZL-70768","DEBIAN-CVE-2022-50260","GHSA-wv25-jjx7-r2r4","ROOT-OS-DEBIAN-11-CVE-2022-50260","ROOT-OS-UBUNTU-2204-CVE-2022-50260","UBUNTU-CVE-2022-50260"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel DRM driver","requires_auth":"low_privilege","summary":"A kernel panic can occur during system shutdown if DRM hardware components fail to bind, leading to a denial of service.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Make .remove and .shutdown HW shutdown consistent\n\nDrivers' .remove and .shutdown callbacks are executed on different code\npaths. The former is called when a device is removed from the bus, while\nthe latter is called at system shutdown time to quiesce the device.\n\nThis means that some overlap exists between the two, because both have to\ntake care of properly shutting down the hardware. But currently the logic\nused in these two callbacks isn't consistent in msm drivers, which could\nlead to kernel panic.\n\nFor example, on .remove the component is deleted and its .unbind callback\nleads to the hardware being shutdown but only if the DRM device has been\nmarked as registered.\n\nThat check doesn't exist in the .shutdown logic and this can lead to the\ndriver calling drm_atomic_helper_shutdown() for a DRM device that hasn't\nbeen properly initialized.\n\nA situation like this can happen if drivers for expected sub-devices fail\nto probe, since the .bind callback will never be executed. If that is the\ncase, drm_atomic_helper_shutdown() will attempt to take mutexes that are\nonly initialized if drm_mode_config_init() is called during a device bind.\n\nThis bug was attempted to be fixed in commit 623f279c7781 (\"drm/msm: fix\nshutdown hook in case GPU components failed to bind\"), but unfortunately\nit still happens in some cases as the one mentioned above, i.e:\n\n  systemd-shutdown[1]: Powering off.\n  kvm: exiting hardware virtualization\n  platform wifi-firmware.0: Removing from iommu group 12\n  platform video-firmware.0: Removing from iommu group 10\n  ------------[ cut here ]------------\n  WARNING: CPU: 6 PID: 1 at drivers/gpu/drm/drm_modeset_lock.c:317 drm_modeset_lock_all_ctx+0x3c4/0x3d0\n  ...\n  Hardware name: Google CoachZ (rev3+) (DT)\n  pstate: a0400009 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n  pc : drm_modeset_lock_all_ctx+0x3c4/0x3d0\n  lr : drm_modeset_lock_all_ctx+0x48/0x3d0\n  sp : ffff80000805bb80\n  x29: ffff80000805bb80 x28: ffff327c00128000 x27: 0000000000000000\n  x26: 0000000000000000 x25: 0000000000000001 x24: ffffc95d820ec030\n  x23: ffff327c00bbd090 x22: ffffc95d8215eca0 x21: ffff327c039c5800\n  x20: ffff327c039c5988 x19: ffff80000805bbe8 x18: 0000000000000034\n  x17: 000000040044ffff x16: ffffc95d80cac920 x15: 0000000000000000\n  x14: 0000000000000315 x13: 0000000000000315 x12: 0000000000000000\n  x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000\n  x8 : ffff80000805bc28 x7 : 0000000000000000 x6 : 0000000000000000\n  x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000\n  x2 : ffff327c00128000 x1 : 0000000000000000 x0 : ffff327c039c59b0\n  Call trace:\n   drm_modeset_lock_all_ctx+0x3c4/0x3d0\n   drm_atomic_helper_shutdown+0x70/0x134\n   msm_drv_shutdown+0x30/0x40\n   platform_shutdown+0x28/0x40\n   device_shutdown+0x148/0x350\n   kernel_power_off+0x38/0x80\n   __do_sys_reboot+0x288/0x2c0\n   __arm64_sys_reboot+0x28/0x34\n   invoke_syscall+0x48/0x114\n   el0_svc_common.constprop.0+0x44/0xec\n   do_el0_svc+0x2c/0xc0\n   el0_svc+0x2c/0x84\n   el0t_64_sync_handler+0x11c/0x150\n   el0t_64_sync+0x18c/0x190\n  ---[ end trace 0000000000000000 ]---\n  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018\n  Mem abort info:\n    ESR = 0x0000000096000004\n    EC = 0x25: DABT (current EL), IL = 32 bits\n    SET = 0, FnV = 0\n    EA = 0, S1PTW = 0\n    FSC = 0x04: level 0 translation fault\n  Data abort info:\n    ISV = 0, ISS = 0x00000004\n    CM = 0, WnR = 0\n  user pgtable: 4k pages, 48-bit VAs, pgdp=000000010eab1000\n  [0000000000000018] pgd=0000000000000000, p4d=0000000000000000\n  Internal error: Oops: 96000004 [#1] PREEMPT SMP\n  ...\n  Hardware name: Google CoachZ (rev3+) (DT)\n  pstate: a0400009 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n  pc : ww_mutex_lock+0x28/0x32c\n  lr : drm_modeset_lock_all_ctx+0x1b0/0x3d0\n  sp : ffff80000805bb50\n  x29: ffff80000805bb50 x28: ffff327c00128000 x27: 0000000000000000\n  x26: 00000\n---truncated---","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"drm/msm: Make .remove and .shutdown HW shutdown consistent","id":"CVE-2022-50260","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"null_dereference","year":"2022"},"n_packages":0,"n_references":3,"next":{"headline":"drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid()","id":"CVE-2022-50261"},"packages":[],"prev":{"headline":"bpf, sockmap: fix race in sock_map_free()","id":"CVE-2022-50259"},"products":["Linux"],"published":"2025-09-15","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-05-23","vendors":["Linux"]},"summary":"A kernel panic can occur during system shutdown if DRM hardware components fail to bind, leading to a denial of service.","url":"https://insights.sbomify.com/CVE-2022-50260/"}