PT-2025-26103 · Linux+3 · Linux Kernel+3

Published 2022-11-08 · Updated 2025-06-18 · CVE-2022-50177

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.18.0

Description The Linux kernel has a vulnerability related to RCU priority boosting. This issue can occur in two situations: when the total number of CPUs is higher than those brought online at boot, and when ksoftirqd kthreads are boosted after the creation of rcu torture boost() kthreads. This can trigger a failure in RCU priority boosting. The issue can be reproduced with specific configurations, such as running ./kvm.sh with certain options.

Recommendations For Linux kernel versions prior to 5.18.0, consider updating to a newer version to resolve the issue. As a temporary workaround, consider disabling the rcu torture boost() function until a patch is available. Restrict access to the vulnerable ksoftirqd kthreads to minimize the risk of exploitation. Avoid using the rcu torture stats print() function in the affected kernel versions until the issue is resolved.

Exploit

Fix

Related Identifiers

CESA-2022_7683

CVE-2022-50177

RHSA-2022:7683

RHSA-2022_7683

RHSA-2024:9315

RHSA-2024_9315

Affected Products

Astra Linux

Centos

Linux Kernel

Red Hat

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50177.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-50177 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-50177 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-50177 · Vendor Advisory
• https://git.kernel.org/stable/c/3002153a91a9732a6d1d0bb95138593c7da15743 · Patch
• https://git.kernel.org/stable/c/621595f771a6bd458ffbc40679e222ba5d0a7a1e · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-50177 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-50177 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50177 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-50177 · Security Note
• https://git.kernel.org/stable/c/8e84693621f53bf894af9905a6531e0530402145 · Patch
• https://git.kernel.org/stable/c/7e7472c62c6ded322afd9d5ac8bb20a08e7c5674 · Patch
• https://lore.kernel.org/linux-cve-announce/2025061831-CVE-2022-50177-1d63@gregkh/T · Note
• https://twitter.com/CVEnew/status/1935351030306464229 · Twitter Post
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note