PT-2025-41037 · Linux+3 · Linux Kernel+3

Published 2022-11-25 · Updated 2025-12-04 · CVE-2022-50532

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.0-rc1+ #189

Description The Linux kernel contains a flaw within the mpt3sas transport port add() function in the SCSI subsystem. Specifically, if sas rphy add() fails, the necessary resource freeing via sas rphy free() is not performed, leading to potential resource leaks. This can ultimately result in a kernel crash due to a NULL pointer dereference when sas rphy remove() is called during device removal. The crash occurs when attempting to access memory at a virtual address, as indicated by the kernel panic message. The function device del() is involved in the call trace leading to the crash.

Recommendations Update to a version of the Linux kernel newer than 6.1.0-rc1+ #189.

Exploit

Fix

Memory Leak

NULL Pointer Dereference

Weakness Enumeration

CWE-401

CWE-476

Related Identifiers

BDU:2026-03813

CESA-2023_7077

CVE-2022-50532

RHSA-2023:6583

RHSA-2023:7077

RHSA-2023_6583

RHSA-2023_7077

SUSE-SU-2025:4111-1

SUSE-SU-2025:4135-1

SUSE-SU-2025:4139-1

SUSE-SU-2025:4149-1

SUSE-SU-2025:4188-1

SUSE-SU-2025:4189-1

SUSE-SU-2025:4320-1

Affected Products

Centos

Linux Kernel

Red Hat

Suse

References · 631

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50532.json · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2025:4135-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4149-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4111-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4139-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-50532 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-50532 · Security Note
• https://git.kernel.org/stable/c/6f6768e2fc8638fabdd8802c2ef693d7aef01db1 · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-50532 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-50532 · Vendor Advisory
• https://git.kernel.org/stable/c/d60000cb1195a464080b0efb4949daf7594e0020 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:4188-1 · Vendor Advisory
• https://git.kernel.org/stable/c/ce1a69cc85006b494353911b35171da195d79e25 · Patch
• https://git.kernel.org/stable/c/d17bca3ddfe507874cb826d32721552da12e741f · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-50532 · Vendor Advisory