{"id":"CVE-2022-50219","summary":"bpf: Fix KASAN use-after-free Read in compute_effective_progs","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix KASAN use-after-free Read in compute_effective_progs\n\nSyzbot found a Use After Free bug in compute_effective_progs().\nThe reproducer creates a number of BPF links, and causes a fault\ninjected alloc to fail, while calling bpf_link_detach on them.\nLink detach triggers the link to be freed by bpf_link_free(),\nwhich calls __cgroup_bpf_detach() and update_effective_progs().\nIf the memory allocation in this function fails, the function restores\nthe pointer to the bpf_cgroup_link on the cgroup list, but the memory\ngets freed just after it returns. After this, every subsequent call to\nupdate_effective_progs() causes this already deallocated pointer to be\ndereferenced in prog_list_length(), and triggers KASAN UAF error.\n\nTo fix this issue don't preserve the pointer to the prog or link in the\nlist, but remove it and replace it with a dummy prog without shrinking\nthe table. The subsequent call to __cgroup_bpf_detach() or\n__cgroup_bpf_detach() will correct it.","modified":"2026-04-02T08:28:19.909428Z","published":"2025-06-18T11:03:54.711Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50219.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/1f8ca9c40e6222ce431e9ba5dae3cccce8ef9443"},{"type":"WEB","url":"https://git.kernel.org/stable/c/3527e3cbb84d8868c4d4e91ba55915f96d39ec3d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4c46091ee985ae84c60c5e95055d779fcd291d87"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6336388715afa419cc97d0255bda3bba1b96b7ca"},{"type":"WEB","url":"https://git.kernel.org/stable/c/be001f9da71eaa3b61e186fb88bde3279728bdca"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50219.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-50219"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"af6eea57437a830293eab56246b6025cc7d46ee7"},{"fixed":"3527e3cbb84d8868c4d4e91ba55915f96d39ec3d"},{"fixed":"1f8ca9c40e6222ce431e9ba5dae3cccce8ef9443"},{"fixed":"6336388715afa419cc97d0255bda3bba1b96b7ca"},{"fixed":"be001f9da71eaa3b61e186fb88bde3279728bdca"},{"fixed":"4c46091ee985ae84c60c5e95055d779fcd291d87"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50219.json"}}],"schema_version":"1.7.5"}