PT-2025-37640 · Linux+1 · Linux Kernel+1

Published 2025-09-15 · Updated 2026-04-20 · CVE-2022-50338

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.10.150-00001-gdc8dcf942daa

Description A use-after-free (UAF) vulnerability exists within the binder component of the Linux kernel. The vulnerability occurs due to a race condition between binder update page range() and vm area free() in munmap(), potentially leading to memory corruption. Specifically, accesses to alloc->vma within binder update page range() can race with the freeing of the vma in munmap(). This issue is specific to stable kernel branches 5.4 and 5.10 and was resolved by reverting to taking the mmap write lock inside binder update page range(). Newer kernel releases have been refactored to use vma lookup(), which avoids this issue.

Recommendations Update the Linux kernel to a version newer than 5.10.150-00001-gdc8dcf942daa.

Related Identifiers

CVE-2022-50338

Affected Products

Astra Linux

Linux Kernel

References · 11

• https://ubuntu.com/security/CVE-2022-50338 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-50338 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-50338 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-50338 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2022-50338 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50338 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2022-50338 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-50338 · Vendor Advisory
• https://twitter.com/CVEnew/status/1967608526651691408 · Twitter Post
• https://git.kernel.org/stable/c/27a594bc7a7c8238d239e3cdbcf2edfa3bbe9a1b · Note
• https://git.kernel.org/linus/27a594bc7a7c8238d239e3cdbcf2edfa3bbe9a1b · Note