CVE-2022-50354

EUVD-2022-55644

17.09.2025, 15:15

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix kfd_process_device_init_vm error handling

Should only destroy the ib_mem and let process cleanup worker to free
the outstanding BOs. Reset the pointer in pdd->qpd structure, to avoid
NULL pointer access in process destroy worker.

 BUG: kernel NULL pointer dereference, address: 0000000000000010
 Call Trace:
  amdgpu_amdkfd_gpuvm_unmap_gtt_bo_from_kernel+0x46/0xb0 [amdgpu]
  kfd_process_device_destroy_cwsr_dgpu+0x40/0x70 [amdgpu]
  kfd_process_destroy_pdds+0x71/0x190 [amdgpu]
  kfd_process_wq_release+0x2a2/0x3b0 [amdgpu]
  process_one_work+0x2a1/0x600
  worker_thread+0x39/0x3d0

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.5 MEDIUM	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 2%

Affected Products (NVD)

Vendor	Product	Version
linux	linux_kernel	5.16 ≤ 𝑥 < 6.0.19
linux	linux_kernel	6.1 ≤ 𝑥 < 6.1.5

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

linux

bookworm	6.1.148-1 fixed
bookworm (security)	6.1.147-1 fixed
bullseye	vulnerable
bullseye (security)	vulnerable
forky	6.16.7-1 fixed
sid	6.16.7-1 fixed
trixie	6.12.43-1 fixed
trixie (security)	6.12.41-1 fixed

openSUSE / SLES Releases

openSUSE Product

Release

cluster-md-kmp-default

suse enterprise server 15 SP5

5.14.21-150500.55.124.1

fixed

dlm-kmp-default

suse enterprise server 15 SP5

5.14.21-150500.55.124.1

fixed

gfs2-kmp-default

suse enterprise server 15 SP5

5.14.21-150500.55.124.1

fixed

kernel-64kb

suse enterprise server 15 SP5

5.14.21-150500.55.124.1

fixed

kernel-default

suse enterprise server 15 SP5

5.14.21-150500.55.124.1

fixed

kernel-default-base

suse enterprise server 15 SP5

5.14.21-150500.55.124.1.150500.6.59.1

fixed

kernel-docs

suse enterprise server 15 SP5

5.14.21-150500.55.124.1

fixed

kernel-macros

suse enterprise server 15 SP5

5.14.21-150500.55.124.1

fixed

kernel-obs-build

suse enterprise server 15 SP5

5.14.21-150500.55.124.1

fixed

kernel-source

suse enterprise server 15 SP5

5.14.21-150500.55.124.1

fixed

kernel-syms

suse enterprise server 15 SP5

5.14.21-150500.55.124.1

fixed

kernel-zfcpdump

suse enterprise server 15 SP5

5.14.21-150500.55.124.1

fixed

ocfs2-kmp-default

suse enterprise server 15 SP5

5.14.21-150500.55.124.1

fixed

reiserfs-kmp-default

suse enterprise server 15 SP5

5.14.21-150500.55.124.1

fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

bpftool

RHEL 8	0:4.18.0-513.5.1.el8_9 fixed
RHEL 9	0:7.2.0-362.8.1.el9_3 fixed

kernel

RHEL 8	0:4.18.0-513.5.1.el8_9 fixed
RHEL 9	0:5.14.0-362.8.1.el9_3 fixed

kernel-64k

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-64k-core

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-64k-debug

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-64k-debug-core

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-64k-debug-devel

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-64k-debug-devel-matched

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-64k-debug-modules

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-64k-debug-modules-core

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-64k-debug-modules-extra

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-64k-devel

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-64k-devel-matched

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-64k-modules

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-64k-modules-core

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-64k-modules-extra

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-abi-stablelists

RHEL 8	0:4.18.0-513.5.1.el8_9 fixed
RHEL 9	0:5.14.0-362.8.1.el9_3 fixed

kernel-core

RHEL 8	0:4.18.0-513.5.1.el8_9 fixed
RHEL 9	0:5.14.0-362.8.1.el9_3 fixed

kernel-debug

RHEL 8	0:4.18.0-513.5.1.el8_9 fixed
RHEL 9	0:5.14.0-362.8.1.el9_3 fixed

kernel-debug-core

RHEL 8	0:4.18.0-513.5.1.el8_9 fixed
RHEL 9	0:5.14.0-362.8.1.el9_3 fixed

kernel-debug-devel

RHEL 8	0:4.18.0-513.5.1.el8_9 fixed
RHEL 9	0:5.14.0-362.8.1.el9_3 fixed

kernel-debug-devel-matched

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-debug-modules

RHEL 8	0:4.18.0-513.5.1.el8_9 fixed
RHEL 9	0:5.14.0-362.8.1.el9_3 fixed

kernel-debug-modules-core

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-debug-modules-extra

RHEL 8	0:4.18.0-513.5.1.el8_9 fixed
RHEL 9	0:5.14.0-362.8.1.el9_3 fixed

kernel-debug-uki-virt

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-devel

RHEL 8	0:4.18.0-513.5.1.el8_9 fixed
RHEL 9	0:5.14.0-362.8.1.el9_3 fixed

kernel-devel-matched

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-doc

RHEL 8	0:4.18.0-513.5.1.el8_9 fixed
RHEL 9	0:5.14.0-362.8.1.el9_3 fixed

kernel-modules

RHEL 8	0:4.18.0-513.5.1.el8_9 fixed
RHEL 9	0:5.14.0-362.8.1.el9_3 fixed

kernel-modules-core

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-modules-extra

RHEL 8	0:4.18.0-513.5.1.el8_9 fixed
RHEL 9	0:5.14.0-362.8.1.el9_3 fixed

kernel-rt

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-rt-core

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-rt-debug

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-rt-debug-core

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-rt-debug-devel

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-rt-debug-kvm

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-rt-debug-modules

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-rt-debug-modules-core

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-rt-debug-modules-extra

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-rt-devel

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-rt-kvm

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-rt-modules

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-rt-modules-core

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-rt-modules-extra

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-tools

RHEL 8	0:4.18.0-513.5.1.el8_9 fixed
RHEL 9	0:5.14.0-362.8.1.el9_3 fixed

kernel-tools-libs

RHEL 8	0:4.18.0-513.5.1.el8_9 fixed
RHEL 9	0:5.14.0-362.8.1.el9_3 fixed

kernel-tools-libs-devel

RHEL 8	0:4.18.0-513.5.1.el8_9 fixed
RHEL 9	0:5.14.0-362.8.1.el9_3 fixed

kernel-uki-virt

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-zfcpdump

RHEL 8	0:4.18.0-513.5.1.el8_9 fixed
RHEL 9	0:5.14.0-362.8.1.el9_3 fixed

kernel-zfcpdump-core

RHEL 8	0:4.18.0-513.5.1.el8_9 fixed
RHEL 9	0:5.14.0-362.8.1.el9_3 fixed

kernel-zfcpdump-devel

RHEL 8	0:4.18.0-513.5.1.el8_9 fixed
RHEL 9	0:5.14.0-362.8.1.el9_3 fixed

kernel-zfcpdump-devel-matched

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-zfcpdump-modules

RHEL 8	0:4.18.0-513.5.1.el8_9 fixed
RHEL 9	0:5.14.0-362.8.1.el9_3 fixed

kernel-zfcpdump-modules-core

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

kernel-zfcpdump-modules-extra

RHEL 8	0:4.18.0-513.5.1.el8_9 fixed
RHEL 9	0:5.14.0-362.8.1.el9_3 fixed

libperf

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

perf

RHEL 8	0:4.18.0-513.5.1.el8_9 fixed
RHEL 9	0:5.14.0-362.8.1.el9_3 fixed

python3-perf

RHEL 8	0:4.18.0-513.5.1.el8_9 fixed
RHEL 9	0:5.14.0-362.8.1.el9_3 fixed

rtla

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

RHEL 9

0:5.14.0-362.8.1.el9_3

fixed

Common Weakness Enumeration

CWE-476 - NULL Pointer Dereference
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

References

https://git.kernel.org/stable/c/29d48b87db64b6697ddad007548e51d032081c59

https://git.kernel.org/stable/c/9d74d1f52e16d8e07f7fbe52e96d6391418a2fe9

https://git.kernel.org/stable/c/b6e78bd3bf2eb964c95eb2596d3cd367307a20b5