PT-2025-38019 · Linux+4 · Linux Kernel+4

Published 2022-01-01 · Updated 2026-04-20 · CVE-2022-50350

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists between the login work function and the login thread in the iSCSI target implementation. A malicious initiator sending data immediately after a login PDU can cause the iscsi target sk data ready() callback to schedule login work. If negotiation completes without clearing the LOGIN FLAGS INITIAL PDU flag, login work will repeatedly reschedule itself. Subsequently, if the initiator terminates the connection, a NULL pointer dereference occurs when login work attempts to access a freed socket structure, leading to a kernel crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

AZL-71155

BDU:2026-06038

CESA-2023_2951

CVE-2022-50350

OESA-2025-2406

OESA-2025-2407

OESA-2025-2408

RHSA-2023:2458

RHSA-2023:2951

RHSA-2023_2458

RHSA-2023_2951

SUSE-SU-2025:4189-1

Affected Products

Centos

Debian

Linux Kernel

Red Hat

Suse

References · 357

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50350.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-53241 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-39883 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-38086 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-39866 · Security Note
• https://osv.dev/vulnerability/OESA-2025-2406 · Vendor Advisory
• https://git.kernel.org/stable/c/3ecdca49ca49d4770639d81503c873b6d25887c4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-53438 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-50297 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2022-50350 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-53318 · Security Note
• https://git.kernel.org/stable/c/fec1b2fa62c162d03f5dcd7b03e3c89d3116d49f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-50404 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-53165 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-50350 · Vendor Advisory