{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2022-50752 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2022-50752 is a high-severity use after free vulnerability in Linux, published on 24 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-50752 and fix it if it is affected.\n\nWhat it is: CVE-2022-50752 is a high-severity use after free vulnerability in Linux, published on 24 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2022-50752 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-50752/ (Markdown: https://insights.sbomify.com/CVE-2022-50752/index.md)","id":"CVE-2022-50752","markdown":"https://insights.sbomify.com/CVE-2022-50752/index.md","name":"CVE-2022-50752","record":{"aliases":["DEBIAN-CVE-2022-50752","GHSA-gg2j-w22v-f248","UBUNTU-CVE-2022-50752"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A double free vulnerability in the Linux kernel RAID5 driver can cause a system crash when reading from disks with bad blocks.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk()\n\nWhen running chunk-sized reads on disks with badblocks duplicate bio\nfree/puts are observed:\n\n   =============================================================================\n   BUG bio-200 (Not tainted): Object already free\n   -----------------------------------------------------------------------------\n   Allocated in mempool_alloc_slab+0x17/0x20 age=3 cpu=2 pid=7504\n    __slab_alloc.constprop.0+0x5a/0xb0\n    kmem_cache_alloc+0x31e/0x330\n    mempool_alloc_slab+0x17/0x20\n    mempool_alloc+0x100/0x2b0\n    bio_alloc_bioset+0x181/0x460\n    do_mpage_readpage+0x776/0xd00\n    mpage_readahead+0x166/0x320\n    blkdev_readahead+0x15/0x20\n    read_pages+0x13f/0x5f0\n    page_cache_ra_unbounded+0x18d/0x220\n    force_page_cache_ra+0x181/0x1c0\n    page_cache_sync_ra+0x65/0xb0\n    filemap_get_pages+0x1df/0xaf0\n    filemap_read+0x1e1/0x700\n    blkdev_read_iter+0x1e5/0x330\n    vfs_read+0x42a/0x570\n   Freed in mempool_free_slab+0x17/0x20 age=3 cpu=2 pid=7504\n    kmem_cache_free+0x46d/0x490\n    mempool_free_slab+0x17/0x20\n    mempool_free+0x66/0x190\n    bio_free+0x78/0x90\n    bio_put+0x100/0x1a0\n    raid5_make_request+0x2259/0x2450\n    md_handle_request+0x402/0x600\n    md_submit_bio+0xd9/0x120\n    __submit_bio+0x11f/0x1b0\n    submit_bio_noacct_nocheck+0x204/0x480\n    submit_bio_noacct+0x32e/0xc70\n    submit_bio+0x98/0x1a0\n    mpage_readahead+0x250/0x320\n    blkdev_readahead+0x15/0x20\n    read_pages+0x13f/0x5f0\n    page_cache_ra_unbounded+0x18d/0x220\n   Slab 0xffffea000481b600 objects=21 used=0 fp=0xffff8881206d8940 flags=0x17ffffc0010201(locked|slab|head|node=0|zone=2|lastcpupid=0x1fffff)\n   CPU: 0 PID: 34525 Comm: kworker/u24:2 Not tainted 6.0.0-rc2-localyes-265166-gf11c5343fa3f #143\n   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014\n   Workqueue: raid5wq raid5_do_work\n   Call Trace:\n    \u003cTASK\u003e\n    dump_stack_lvl+0x5a/0x78\n    dump_stack+0x10/0x16\n    print_trailer+0x158/0x165\n    object_err+0x35/0x50\n    free_debug_processing.cold+0xb7/0xbe\n    __slab_free+0x1ae/0x330\n    kmem_cache_free+0x46d/0x490\n    mempool_free_slab+0x17/0x20\n    mempool_free+0x66/0x190\n    bio_free+0x78/0x90\n    bio_put+0x100/0x1a0\n    mpage_end_io+0x36/0x150\n    bio_endio+0x2fd/0x360\n    md_end_io_acct+0x7e/0x90\n    bio_endio+0x2fd/0x360\n    handle_failed_stripe+0x960/0xb80\n    handle_stripe+0x1348/0x3760\n    handle_active_stripes.constprop.0+0x72a/0xaf0\n    raid5_do_work+0x177/0x330\n    process_one_work+0x616/0xb20\n    worker_thread+0x2bd/0x6f0\n    kthread+0x179/0x1b0\n    ret_from_fork+0x22/0x30\n    \u003c/TASK\u003e\n\nThe double free is caused by an unnecessary bio_put() in the\nif(is_badblock(...)) error path in raid5_read_one_chunk().\n\nThe error path was moved ahead of bio_alloc_clone() in c82aa1b76787c\n(\"md/raid5: move checking badblock before clone bio in\nraid5_read_one_chunk\"). The previous code checked and freed align_bio\nwhich required a bio_put. After the move that is no longer needed as\nraid_bio is returned to the control of the common io path which\nperforms its own endio resulting in a double free on bad device blocks.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk()","id":"CVE-2022-50752","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2022"},"n_packages":0,"n_references":4,"next":{"headline":"f2fs: fix to do sanity check on summary info","id":"CVE-2022-50753"},"packages":[],"prev":{"headline":"configfs: fix possible memory leak in configfs_create_dir()","id":"CVE-2022-50751"},"products":["Linux"],"published":"2025-12-24","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-08-05","vendors":["Linux"]},"summary":"A double free vulnerability in the Linux kernel RAID5 driver can cause a system crash when reading from disks with bad blocks.","url":"https://insights.sbomify.com/CVE-2022-50752/"}