CVE-2022-50697

EUVD-2025-205183
In the Linux kernel, the following vulnerability has been resolved:

mrp: introduce active flags to prevent UAF when applicant uninit

The caller of del_timer_sync must prevent restarting of the timer, If
we have no this synchronization, there is a small probability that the
cancellation will not be successful.

And syzbot report the fellowing crash:
==================================================================
BUG: KASAN: use-after-free in hlist_add_head include/linux/list.h:929 [inline]
BUG: KASAN: use-after-free in enqueue_timer+0x18/0xa4 kernel/time/timer.c:605
Write at addr f9ff000024df6058 by task syz-fuzzer/2256
Pointer tag: [f9], memory tag: [fe]

CPU: 1 PID: 2256 Comm: syz-fuzzer Not tainted 6.1.0-rc5-syzkaller-00008-
ge01d50cbd6ee #0
Hardware name: linux,dummy-virt (DT)
Call trace:
 dump_backtrace.part.0+0xe0/0xf0 arch/arm64/kernel/stacktrace.c:156
 dump_backtrace arch/arm64/kernel/stacktrace.c:162 [inline]
 show_stack+0x18/0x40 arch/arm64/kernel/stacktrace.c:163
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x68/0x84 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:284 [inline]
 print_report+0x1a8/0x4a0 mm/kasan/report.c:395
 kasan_report+0x94/0xb4 mm/kasan/report.c:495
 __do_kernel_fault+0x164/0x1e0 arch/arm64/mm/fault.c:320
 do_bad_area arch/arm64/mm/fault.c:473 [inline]
 do_tag_check_fault+0x78/0x8c arch/arm64/mm/fault.c:749
 do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:825
 el1_abort+0x40/0x60 arch/arm64/kernel/entry-common.c:367
 el1h_64_sync_handler+0xd8/0xe4 arch/arm64/kernel/entry-common.c:427
 el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:576
 hlist_add_head include/linux/list.h:929 [inline]
 enqueue_timer+0x18/0xa4 kernel/time/timer.c:605
 mod_timer+0x14/0x20 kernel/time/timer.c:1161
 mrp_periodic_timer_arm net/802/mrp.c:614 [inline]
 mrp_periodic_timer+0xa0/0xc0 net/802/mrp.c:627
 call_timer_fn.constprop.0+0x24/0x80 kernel/time/timer.c:1474
 expire_timers+0x98/0xc4 kernel/time/timer.c:1519

To fix it, we can introduce a new active flags to make sure the timer will
not restart.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 14%
Debian logo
Debian Releases
Debian Product
Codename
linux
bookworm
6.1.148-1
fixed
bookworm (security)
6.1.158-1
fixed
bullseye
5.10.223-1
fixed
bullseye (security)
5.10.247-1
fixed
forky
6.17.12-1
fixed
sid
6.17.13-1
fixed
trixie
6.12.57-1
fixed
trixie (security)
6.12.48-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
linux
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
plucky
needs-triage
questing
needs-triage
trusty
needs-triage
xenial
needs-triage
linux-hwe
bionic
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
xenial
needs-triage
linux-hwe-5.4
bionic
needs-triage
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-hwe-5.8
focal
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-hwe-5.11
focal
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-hwe-5.13
focal
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-hwe-5.15
focal
needs-triage
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-hwe-5.19
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-hwe-6.2
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-hwe-6.5
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-hwe-6.8
jammy
needs-triage
noble
dne
plucky
dne
questing
dne
linux-hwe-6.11
jammy
dne
noble
ignored
plucky
dne
questing
dne
linux-hwe-6.14
jammy
dne
noble
needs-triage
plucky
dne
questing
dne
linux-hwe-edge
bionic
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
xenial
ignored
linux-lts-xenial
jammy
dne
noble
dne
plucky
dne
questing
dne
trusty
needs-triage
linux-kvm
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
dne
plucky
dne
questing
dne
xenial
needs-triage
linux-allwinner-5.19
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-aws
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
plucky
needs-triage
questing
needs-triage
trusty
needs-triage
xenial
needs-triage
linux-aws-5.0
bionic
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-aws-5.3
bionic
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-aws-5.4
bionic
needs-triage
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-aws-5.8
focal
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-aws-5.11
focal
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-aws-5.13
focal
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-aws-5.15
focal
needs-triage
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-aws-5.19
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-aws-6.2
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-aws-6.5
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-aws-6.8
jammy
needs-triage
noble
dne
plucky
dne
questing
dne
linux-aws-6.14
jammy
dne
noble
needs-triage
plucky
dne
questing
dne
linux-aws-hwe
jammy
dne
noble
dne
plucky
dne
questing
dne
xenial
needs-triage
linux-azure
bionic
ignored
focal
needs-triage
jammy
needs-triage
noble
needs-triage
plucky
needs-triage
questing
needs-triage
trusty
needs-triage
xenial
needs-triage
linux-azure-4.15
bionic
needs-triage
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-azure-5.3
bionic
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-azure-5.4
bionic
needs-triage
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-azure-5.8
focal
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-azure-5.11
focal
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-azure-5.13
focal
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-azure-5.15
focal
needs-triage
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-azure-5.19
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-azure-6.2
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-azure-6.5
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-azure-6.8
jammy
needs-triage
noble
dne
plucky
dne
questing
dne
linux-azure-6.11
jammy
dne
noble
ignored
plucky
dne
questing
dne
linux-azure-6.14
jammy
dne
noble
needs-triage
plucky
dne
questing
dne
linux-azure-fde
focal
ignored
jammy
needs-triage
noble
needs-triage
plucky
needs-triage
questing
dne
linux-azure-fde-5.15
focal
needs-triage
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-azure-fde-5.19
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-azure-fde-6.2
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-azure-fde-6.8
jammy
needs-triage
noble
dne
plucky
dne
questing
dne
linux-azure-fde-6.14
jammy
dne
noble
needs-triage
plucky
dne
questing
dne
linux-azure-nvidia
jammy
dne
noble
needs-triage
plucky
dne
questing
dne
linux-azure-nvidia-6.14
jammy
dne
noble
needs-triage
plucky
dne
questing
dne
linux-bluefield
focal
needs-triage
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-azure-edge
bionic
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-fips
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
plucky
dne
questing
dne
xenial
needs-triage
linux-aws-fips
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
plucky
dne
questing
dne
linux-azure-fips
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
plucky
dne
questing
dne
linux-gcp-fips
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
plucky
dne
questing
dne
linux-gcp
bionic
ignored
focal
needs-triage
jammy
needs-triage
noble
needs-triage
plucky
needs-triage
questing
needs-triage
xenial
needs-triage
linux-gcp-4.15
bionic
needs-triage
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-gcp-5.3
bionic
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-gcp-5.4
bionic
needs-triage
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-gcp-5.8
focal
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-gcp-5.11
focal
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-gcp-5.13
focal
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-gcp-5.15
focal
needs-triage
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-gcp-5.19
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-gcp-6.2
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-gcp-6.5
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-gcp-6.8
jammy
needs-triage
noble
dne
plucky
dne
questing
dne
linux-gcp-6.11
jammy
dne
noble
ignored
plucky
dne
questing
dne
linux-gcp-6.14
jammy
dne
noble
needs-triage
plucky
dne
questing
dne
linux-gke
focal
ignored
jammy
needs-triage
noble
needs-triage
plucky
dne
questing
dne
linux-gke-4.15
bionic
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-gke-5.4
bionic
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-gke-5.15
focal
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-gkeop
focal
ignored
jammy
needs-triage
noble
needs-triage
plucky
dne
questing
dne
linux-gkeop-5.4
bionic
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-gkeop-5.15
focal
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-ibm
focal
needs-triage
jammy
needs-triage
noble
needs-triage
plucky
dne
questing
dne
linux-ibm-5.4
bionic
needs-triage
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-ibm-5.15
focal
needs-triage
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-ibm-6.8
jammy
needs-triage
noble
dne
plucky
dne
questing
dne
linux-intel-5.13
focal
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-intel-iotg
jammy
needs-triage
noble
dne
plucky
dne
questing
dne
linux-intel-iotg-5.15
focal
needs-triage
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-iot
focal
needs-triage
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-intel-iot-realtime
jammy
needs-triage
noble
dne
plucky
dne
questing
dne
linux-lowlatency
jammy
needs-triage
noble
needs-triage
plucky
dne
questing
dne
linux-lowlatency-hwe-5.15
focal
needs-triage
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-lowlatency-hwe-5.19
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-lowlatency-hwe-6.2
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-lowlatency-hwe-6.5
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-lowlatency-hwe-6.8
jammy
needs-triage
noble
dne
plucky
dne
questing
dne
linux-lowlatency-hwe-6.11
jammy
dne
noble
ignored
plucky
dne
questing
dne
linux-nvidia
jammy
needs-triage
noble
needs-triage
plucky
dne
questing
dne
linux-nvidia-6.2
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-nvidia-6.5
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-nvidia-6.8
jammy
needs-triage
noble
dne
plucky
dne
questing
dne
linux-nvidia-6.11
jammy
dne
noble
ignored
plucky
dne
questing
dne
linux-nvidia-lowlatency
jammy
dne
noble
needs-triage
plucky
dne
questing
dne
linux-nvidia-tegra
jammy
needs-triage
noble
needs-triage
plucky
dne
questing
dne
linux-nvidia-tegra-5.15
focal
needs-triage
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-nvidia-tegra-igx
jammy
needs-triage
noble
dne
plucky
dne
questing
dne
linux-oracle
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
plucky
needs-triage
questing
needs-triage
xenial
needs-triage
linux-oracle-5.0
bionic
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-oracle-5.3
bionic
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-oracle-5.4
bionic
needs-triage
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-oracle-5.8
focal
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-oracle-5.11
focal
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-oracle-5.13
focal
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-oracle-5.15
focal
needs-triage
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-oracle-6.5
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-oracle-6.8
jammy
needs-triage
noble
dne
plucky
dne
questing
dne
linux-oracle-6.14
jammy
dne
noble
needs-triage
plucky
dne
questing
dne
linux-oem
bionic
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-oem-5.6
focal
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-oem-5.10
focal
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-oem-5.13
focal
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-oem-5.14
focal
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-oem-5.17
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-oem-6.0
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-oem-6.1
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-oem-6.5
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-oem-6.8
jammy
dne
noble
ignored
plucky
dne
questing
dne
linux-oem-6.11
jammy
dne
noble
ignored
plucky
dne
questing
dne
linux-oem-6.14
jammy
dne
noble
needs-triage
plucky
dne
questing
dne
linux-oem-6.17
jammy
dne
noble
needs-triage
plucky
dne
questing
dne
linux-raspi
focal
needs-triage
jammy
needs-triage
noble
needs-triage
plucky
needs-triage
questing
needs-triage
linux-raspi2
focal
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-raspi-5.4
bionic
needs-triage
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-raspi-realtime
jammy
dne
noble
needs-triage
plucky
dne
questing
dne
linux-realtime
jammy
needs-triage
noble
needs-triage
plucky
needs-triage
questing
needs-triage
linux-realtime-6.8
jammy
needs-triage
noble
dne
plucky
dne
questing
dne
linux-realtime-6.14
jammy
dne
noble
needs-triage
plucky
dne
questing
dne
linux-riscv
focal
ignored
jammy
ignored
noble
ignored
plucky
needs-triage
questing
needs-triage
linux-riscv-5.8
focal
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-riscv-5.11
focal
ignored
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-riscv-5.15
focal
needs-triage
jammy
dne
noble
dne
plucky
dne
questing
dne
linux-riscv-5.19
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-riscv-6.5
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-riscv-6.8
jammy
needs-triage
noble
dne
plucky
dne
questing
dne
linux-riscv-6.14
jammy
dne
noble
ignored
plucky
dne
questing
dne
linux-starfive-5.19
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-starfive-6.2
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-starfive-6.5
jammy
ignored
noble
dne
plucky
dne
questing
dne
linux-xilinx
jammy
dne
noble
needs-triage
plucky
needs-triage
questing
dne
linux-xilinx-zynqmp
focal
needs-triage
jammy
needs-triage
noble
dne
plucky
dne
questing
dne