PT-2025-40111 · Linux+1 · Linux Kernel+1

Published 2022-09-30 · Updated 2026-01-20 · CVE-2022-50426

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel's remoteproc subsystem, specifically within the imx dsp rproc component. A race condition can occur where a workqueue executes after the remoteproc has been stopped, leading to access of released resources (rpmsg device and endpoint). This can result in a kernel dump. The issue arises from the improper handling of interrupts and workqueue operations during the shutdown process of the remoteproc. Specifically, the rproc vq interrupt() function may be called after resources it depends on have already been released by rproc stop subdevices(). A mutex protection has been added to imx dsp rproc vq work() to prevent this issue, skipping the call to rproc vq interrupt() if the state is not running. The flush workqueue operation is also deemed unsafe to be called during the remoteproc stop sequence for the same reason.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-820

Related Identifiers

BDU:2026-03347

CVE-2022-50426

RHSA-2023:6583

RHSA-2023_6583

Affected Products

Linux Kernel

Red Hat

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50426.json · Exploit
• https://security-tracker.debian.org/tracker/CVE-2022-50426 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-50426 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03347 · Security Note
• https://git.kernel.org/stable/c/4a3e1fa7a77838617bdbcd95127ce93a959fad44 · Patch
• https://cve.org/CVERecord?id=CVE-2022-50426 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-50426 · Vendor Advisory
• https://git.kernel.org/stable/c/b9693304b7133b81741add5bfb56f022596df012 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-50426 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50426 · Security Note
• https://git.kernel.org/stable/c/47e6ab07018edebf94ce873cf50a05ec76ff2dde · Patch
• https://ubuntu.com/security/CVE-2022-50426 · Vendor Advisory
• https://git.kernel.org/linus/47e6ab07018edebf94ce873cf50a05ec76ff2dde · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://lore.kernel.org/linux-cve-announce/2025100156-CVE-2022-50426-a61b@gregkh/T · Note