PT-2025-37605 · Linux+4 · Linux+4

Published 2022-01-01 · Updated 2026-04-20 · CVE-2022-50303

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions linux (affected versions not specified)

Description The Linux kernel contains a flaw in the drm/amdkfd subsystem where a double release of the compute pasid can occur. This happens if kfd process device init vm fails after the virtual memory (vm) is converted to a compute vm and vm->pasid is set to the compute pasid. Specifically, the kernel may not take a reference to pdd->drm file, leading to a potential double release of the compute pasid when the drm close file handler is called before the KFD process destroy worker releases the same pasid. This can result in a NULL pointer access and a kernel panic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

AZL-71347

BDU:2026-06080

CESA-2023_7077

CVE-2022-50303

RHSA-2023:6583

RHSA-2023:7077

RHSA-2023_6583

RHSA-2023_7077

SUSE-SU-2025:03615-1

SUSE-SU-2025:3761-1

Affected Products

Centos

Debian

Linux

Red Hat

Suse

References · 836

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50303.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-50303 · Vendor Advisory
• https://git.kernel.org/stable/c/a02c07b619899179384fde06f951530438a3512d · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:3761-1 · Vendor Advisory
• https://git.kernel.org/stable/c/1a799c4c190ea9f0e81028e3eb3037ed0ab17ff5 · Patch
• https://bdu.fstec.ru/vul/2026-06080 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-50303 · Security Note
• https://osv.dev/vulnerability/AZL-71347 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-50303 · Vendor Advisory
• https://git.kernel.org/stable/c/89f0d766c9e3fdeafbed6f855d433c2768cde862 · Patch
• https://osv.dev/vulnerability/CVE-2022-50303 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2022-50303 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50303 · Security Note
• https://ubuntu.com/security/CVE-2022-50303 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2022-50303 · Vendor Advisory