Read the docs
TI-2022-25885 Aliases CVE-2022-50406GHSA-x5q7-34x7-hr6p

iomap: iomap: fix memory corruption when recording errors during writeback

Priority LOW 35CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 21 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.

Summary

In the Linux kernel, the following vulnerability has been resolved: iomap: iomap: fix memory corruption when recording errors during writeback Every now and then I see this crash on arm64: Unable to handle kernel NULL pointer dereference at virtual address 00000000000000f8 Buffer I/O error on dev dm-0, logical block 8733687, async page read Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 user pgtable: 64k pages, 42-bit VAs, pgdp=0000000139750000 [00000000000000f8] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000, pmd=0000000000000000 Internal error: Oops: 96000006 [#1] PREEMPT SMP Buffer I/O error on dev dm-0, logical block 8733688, async page read Dumping ftrace buffer: Buffer I/O error on dev dm-0, logical block 8733689, async page read (ftrace buffer empty) XFS (dm-0): log I/O error -5 Modules linked in: dm_thin_pool dm_persistent_data XFS (dm-0): Metadata I/O Error (0x1) detected at xfs_trans_read_buf_map+0x1ec/0x590 [xfs] (fs/xfs/xfs_trans_buf.c:296). dm_bio_prison XFS (dm-0): Please unmount the filesystem and rectify the problem(s) XFS (dm-0): xfs_imap_lookup: xfs_ialloc_read_agi() returned error -5, agno 0 dm_bufio dm_log_writes xfs nft_chain_nat xt_REDIRECT nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_REJECT potentially unexpected fatal signal 6. nf_reject_ipv6 potentially unexpected fatal signal 6. ipt_REJECT nf_reject_ipv4 CPU: 1 PID: 122166 Comm: fsstress Tainted: G W 6.0.0-rc5-djwa #rc5 3004c9f1de887ebae86015f2677638ce51ee7 rpcsec_gss_krb5 auth_rpcgss xt_tcpudp ip_set_hash_ip ip_set_hash_net xt_set nft_compat ip_set_hash_mac ip_set nf_tables Hardware name: QEMU KVM Virtual Machine, BIOS 1.5.1 06/16/2021 pstate: 60001000 (nZCv daif -PAN -UAO -TCO -DIT +SSBS BTYPE=--) ip_tables pc : 000003fd6d7df200 x_tables lr : 000003fd6d7df1ec overlay nfsv4 CPU: 0 PID: 54031 Comm: u4:3 Tainted: G W 6.0.0-rc5-djwa #rc5 3004c9f1de887ebae86015f2677638ce51ee7405 Hardware name: QEMU KVM Virtual Machine, BIOS 1.5.1 06/16/2021 Workqueue: writeback wb_workfn sp : 000003ffd9522fd0 (flush-253:0) pstate: 60401005 (nZCv daif +PAN -UAO -TCO -DIT +SSBS BTYPE=--) pc : errseq_set+0x1c/0x100 x29: 000003ffd9522fd0 x28: 0000000000000023 x27: 000002acefeb6780 x26: 0000000000000005 x25: 0000000000000001 x24: 0000000000000000 x23: 00000000ffffffff x22: 0000000000000005 lr : __filemap_set_wb_err+0x24/0xe0 x21: 0000000000000006 sp : fffffe000f80f760 x29: fffffe000f80f760 x28: 0000000000000003 x27: fffffe000f80f9f8 x26: 0000000002523000 x25: 00000000fffffffb x24: fffffe000f80f868 x23: fffffe000f80fbb0 x22: fffffc0180c26a78 x21: 0000000002530000 x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000001 x13: 0000000000470af3 x12: fffffc0058f70000 x11: 0000000000000040 x10: 0000000000001b20 x9 : fffffe000836b288 x8 : fffffc00eb9fd480 x7 : 0000000000f83659 x6 : 0000000000000000 x5 : 0000000000000869 x4 : 0000000000000005 x3 : 00000000000000f8 x20: 000003fd6d740020 x19: 000000000001dd36 x18: 0000000000000001 x17: 000003fd6d78704c x16: 0000000000000001 x15: 000002acfac87668 x2 : 0000000000000ffa x1 : 00000000fffffffb x0 : 00000000000000f8 Call trace: errseq_set+0x1c/0x100 __filemap_set_wb_err+0x24/0xe0 iomap_do_writepage+0x5e4/0xd5c write_cache_pages+0x208/0x674 iomap_writepages+0x34/0x60 xfs_vm_writepages+0x8c/0xcc [xfs 7a861f39c43631f15d3a5884246ba5035d4ca78b] x14: 0000000000000000 x13: 2064656e72757465 x12: 0000000000002180 x11: 000003fd6d8a82d0 x10: 0000000000000000 x9 : 000003fd6d8ae288 x8 : 0000000000000083 x7 : 00000000ffffffff x6 : 00000000ffffffee x5 : 00000000fbad2887 x4 : 000003fd6d9abb58 x3 : 000003fd6d740020 x2 : 0000000000000006 x1 : 000000000001dd36 x0 : 0000000000000000 CPU: ---truncated---

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00168 6th percentileScored 2026-11-07
Fix Partial Linux (Linux): 5.10.271, 5.15.222, 5.19.17 +2Red Hat: 12 advisoriesRed Hat: 21 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux4.6 and later5.10.271, 5.15.222, 5.19.17, 6.0.3, 6.1Patch availableCNA
  • Linux VendorLinux Affected 4.6 and later Fixed in 5.10.271, 5.15.222, 5.19.17, 6.0.3, 6.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*4.6 to before 5.19.17; 6.0 to before 6.0.3VulnerableLinux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 4.6 to before 5.19.17; 6.0 to before 6.0.3 Vulnerable ·Linux

Remediation

  • Fix · CNA Linux (Linux) Fixed in 5.10.271, 5.15.222, 5.19.17, 6.0.3, 6.1

Red Hat 12 advisories

  • RHSA-2025:23947 Released 2025-12-22 · Red Hat rating Moderate
    kernel security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) bpftool-3.10.0-1160.144.1.el7, kernel-3.10.0-1160.144.1.el7, kernel-abi-whitelists-3.10.0-1160.144.1.el7 +11
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) kernel-debug-devel-3.10.0-1160.144.1.el7, kernel-tools-libs-devel-3.10.0-1160.144.1.el7
  • RHSA-2025:23960 Released 2025-12-22 · Red Hat rating Moderate
    kernel-rt security update
    • Red Hat Enterprise Linux for Real Time (v. 7 ELS) kernel-rt-3.10.0-1160.144.1.rt56.1296.el7, kernel-rt-debug-3.10.0-1160.144.1.rt56.1296.el7, kernel-rt-debug-devel-3.10.0-1160.144.1.rt56.1296.el7 +4
  • RHSA-2025:23463 Released 2025-12-17 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) bpftool-4.18.0-305.182.1.el8_4, kernel-4.18.0-305.182.1.el8_4, kernel-abi-stablelists-4.18.0-305.182.1.el8_4 +14
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) bpftool-4.18.0-305.182.1.el8_4, kernel-4.18.0-305.182.1.el8_4, kernel-abi-stablelists-4.18.0-305.182.1.el8_4 +14
Show 9 more Red Hat advisories
  • RHSA-2025:23445 Released 2025-12-17 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) bpftool-4.18.0-193.178.1.el8_2, kernel-4.18.0-193.178.1.el8_2, kernel-abi-whitelists-4.18.0-193.178.1.el8_2 +14
  • RHSA-2025:22998 Released 2025-12-10 · Red Hat rating Moderate
    kernel security update
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) bpftool-4.18.0-477.122.1.el8_8, kernel-4.18.0-477.122.1.el8_8, kernel-abi-stablelists-4.18.0-477.122.1.el8_8 +14
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) bpftool-4.18.0-477.122.1.el8_8, kernel-4.18.0-477.122.1.el8_8, kernel-abi-stablelists-4.18.0-477.122.1.el8_8 +14
  • RHSA-2025:21136 Released 2025-11-12 · Red Hat rating Moderate
    kernel-rt security update
    • Red Hat Enterprise Linux NFV E4S (v.9.0) kernel-rt-5.14.0-70.153.1.rt21.225.el9_0, kernel-rt-core-5.14.0-70.153.1.rt21.225.el9_0, kernel-rt-debug-5.14.0-70.153.1.rt21.225.el9_0 +9
    • Red Hat Enterprise Linux Real Time E4S (v.9.0) kernel-rt-5.14.0-70.153.1.rt21.225.el9_0, kernel-rt-core-5.14.0-70.153.1.rt21.225.el9_0, kernel-rt-debug-5.14.0-70.153.1.rt21.225.el9_0 +7
  • RHSA-2025:21128 Released 2025-11-12 · Red Hat rating Moderate
    kernel-rt security update
    • Red Hat Enterprise Linux Real Time E4S (v.9.2) kernel-rt-5.14.0-284.146.1.rt14.431.el9_2, kernel-rt-core-5.14.0-284.146.1.rt14.431.el9_2, kernel-rt-debug-5.14.0-284.146.1.rt14.431.el9_2 +9
    • Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2) kernel-rt-5.14.0-284.146.1.rt14.431.el9_2, kernel-rt-core-5.14.0-284.146.1.rt14.431.el9_2, kernel-rt-debug-5.14.0-284.146.1.rt14.431.el9_2 +11
  • RHSA-2025:21091 Released 2025-11-12 · Red Hat rating Moderate
    kernel security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) kernel-debug-devel-5.14.0-70.153.1.el9_0, kernel-debug-devel-matched-5.14.0-70.153.1.el9_0, kernel-devel-5.14.0-70.153.1.el9_0 +5
    • Red Hat Enterprise Linux BaseOS E4S (v.9.0) bpftool-5.14.0-70.153.1.el9_0, kernel-5.14.0-70.153.1.el9_0, kernel-abi-stablelists-5.14.0-70.153.1.el9_0 +14
  • RHSA-2025:21084 Released 2025-11-12 · Red Hat rating Moderate
    kernel security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) bpftool-4.18.0-372.168.1.el8_6, kernel-4.18.0-372.168.1.el8_6, kernel-abi-stablelists-4.18.0-372.168.1.el8_6 +14
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) bpftool-4.18.0-372.168.1.el8_6, kernel-4.18.0-372.168.1.el8_6, kernel-abi-stablelists-4.18.0-372.168.1.el8_6 +19
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) bpftool-4.18.0-372.168.1.el8_6, kernel-4.18.0-372.168.1.el8_6, kernel-abi-stablelists-4.18.0-372.168.1.el8_6 +14
  • RHSA-2025:21051 Released 2025-11-12 · Red Hat rating Moderate
    kernel security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) kernel-64k-debug-devel-5.14.0-284.146.1.el9_2, kernel-64k-debug-devel-matched-5.14.0-284.146.1.el9_2, kernel-64k-devel-5.14.0-284.146.1.el9_2 +10
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) bpftool-7.0.0-284.146.1.el9_2, kernel-5.14.0-284.146.1.el9_2, kernel-64k-5.14.0-284.146.1.el9_2 +29
  • RHSA-2023:7077 Released 2023-11-14 · Red Hat rating Important
    kernel security, bug fix, and enhancement update
    • Red Hat CodeReady Linux Builder (v. 8) kernel-tools-libs-devel-4.18.0-513.5.1.el8_9
    • Red Hat Enterprise Linux BaseOS (v. 8) bpftool-4.18.0-513.5.1.el8_9, kernel-4.18.0-513.5.1.el8_9, kernel-abi-stablelists-4.18.0-513.5.1.el8_9 +19
  • RHSA-2023:6583 Released 2023-11-07 · Red Hat rating Important
    kernel security, bug fix, and enhancement update
    • Red Hat CodeReady Linux Builder (v. 9) kernel-tools-libs-devel-5.14.0-362.8.1.el9_3, libperf-5.14.0-362.8.1.el9_3
    • Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-362.8.1.el9_3, kernel-64k-debug-devel-matched-5.14.0-362.8.1.el9_3, kernel-64k-devel-5.14.0-362.8.1.el9_3 +11
    • Red Hat Enterprise Linux BaseOS (v. 9) bpftool-7.2.0-362.8.1.el9_3, kernel-5.14.0-362.8.1.el9_3, kernel-64k-5.14.0-362.8.1.el9_3 +29
    • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt-5.14.0-362.8.1.el9_3, kernel-rt-core-5.14.0-362.8.1.el9_3, kernel-rt-debug-5.14.0-362.8.1.el9_3 +9
    • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt-5.14.0-362.8.1.el9_3, kernel-rt-core-5.14.0-362.8.1.el9_3, kernel-rt-debug-5.14.0-362.8.1.el9_3 +11

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat CodeReady Linux Builder (v. 8)Fixed RHSA-2023:7077
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2025:21091
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2025:21051
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2023:7077
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2025:23445
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2025:23463
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2025:21084
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2025:21084
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2025:22998
Red Hat Enterprise Linux BaseOS E4S (v.9.0)Fixed RHSA-2025:21091
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2025:21051
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2025:23463
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2025:21084
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2025:22998
Red Hat Enterprise Linux NFV E4S (v.9.0)Fixed RHSA-2025:21136
Red Hat Enterprise Linux Real Time E4S (v.9.0)Fixed RHSA-2025:21136
Red Hat Enterprise Linux Real Time E4S (v.9.2)Fixed RHSA-2025:21128
Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)Fixed RHSA-2025:21128
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2025:23947
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2025:23947
Red Hat Enterprise Linux for Real Time (v. 7 ELS)Fixed RHSA-2025:23960
Not affected: 2 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-50406
  2. 2026-10-03 Alias added: GHSA-x5q7-34x7-hr6p
  3. 2026-10-03 Fix available: Linux/Linux@169adb79cfd59250a5b1f68cdc69e7287fc5a0ce, Linux/[email protected], Linux/[email protected] +1 · CNA
  4. 2026-10-03 2 new references · CNA

References

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
  • TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
See all 15278 →

Sources