{"id":"DEBIAN-CVE-2022-50563","details":"In the Linux kernel, the following vulnerability has been resolved:  dm thin: Fix UAF in run_timer_softirq()  When dm_resume() and dm_destroy() are concurrent, it will lead to UAF, as follows:   BUG: KASAN: use-after-free in __run_timers+0x173/0x710  Write of size 8 at addr ffff88816d9490f0 by task swapper/0/0 \u003csnip\u003e  Call Trace:   \u003cIRQ\u003e   dump_stack_lvl+0x73/0x9f   print_report.cold+0x132/0xaa2   _raw_spin_lock_irqsave+0xcd/0x160   __run_timers+0x173/0x710   kasan_report+0xad/0x110   __run_timers+0x173/0x710   __asan_store8+0x9c/0x140   __run_timers+0x173/0x710   call_timer_fn+0x310/0x310   pvclock_clocksource_read+0xfa/0x250   kvm_clock_read+0x2c/0x70   kvm_clock_get_cycles+0xd/0x20   ktime_get+0x5c/0x110   lapic_next_event+0x38/0x50   clockevents_program_event+0xf1/0x1e0   run_timer_softirq+0x49/0x90   __do_softirq+0x16e/0x62c   __irq_exit_rcu+0x1fa/0x270   irq_exit_rcu+0x12/0x20   sysvec_apic_timer_interrupt+0x8e/0xc0  One of the concurrency UAF can be shown as below:          use                                  free do_resume                           |   __find_device_hash_cell           |     dm_get                          |       atomic_inc(&md-\u003eholders)      |                                     | dm_destroy                                     |   __dm_destroy                                     |     if (!dm_suspended_md(md))                                     |     atomic_read(&md-\u003eholders)                                     |     msleep(1)   dm_resume                         |     __dm_resume                     |       dm_table_resume_targets       |         pool_resume                 |           do_waker  #add delay work |   dm_put                            |     atomic_dec(&md-\u003eholders)        |                                     |     dm_table_destroy                                     |       pool_dtr                                     |         __pool_dec                                     |           __pool_destroy                                     |             destroy_workqueue                                     |             kfree(pool) # free pool         time out __do_softirq   run_timer_softirq # pool has already been freed  This can be easily reproduced using:   1. create thin-pool   2. dmsetup suspend pool   3. dmsetup resume pool   4. dmsetup remove_all # Concurrent with 3  The root cause of this UAF bug is that dm_resume() adds timer after dm_destroy() skips cancelling the timer because of suspend status. After timeout, it will call run_timer_softirq(), however pool has already been freed. The concurrency UAF bug will happen.  Therefore, cancelling timer again in __pool_destroy().","modified":"2026-09-01T16:05:35.791044290Z","published":"2025-10-22T14:15:41.067Z","upstream":["CVE-2022-50563"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2022-50563"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50563.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50563.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50563.json"}}],"schema_version":"1.9.0"}