{"id":"DEBIAN-CVE-2022-50092","details":"In the Linux kernel, the following vulnerability has been resolved:  dm thin: fix use-after-free crash in dm_sm_register_threshold_callback  Fault inject on pool metadata device reports:   BUG: KASAN: use-after-free in dm_pool_register_metadata_threshold+0x40/0x80   Read of size 8 at addr ffff8881b9d50068 by task dmsetup/950    CPU: 7 PID: 950 Comm: dmsetup Tainted: G        W         5.19.0-rc6 #1   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014   Call Trace:    \u003cTASK\u003e    dump_stack_lvl+0x34/0x44    print_address_description.constprop.0.cold+0xeb/0x3f4    kasan_report.cold+0xe6/0x147    dm_pool_register_metadata_threshold+0x40/0x80    pool_ctr+0xa0a/0x1150    dm_table_add_target+0x2c8/0x640    table_load+0x1fd/0x430    ctl_ioctl+0x2c4/0x5a0    dm_ctl_ioctl+0xa/0x10    __x64_sys_ioctl+0xb3/0xd0    do_syscall_64+0x35/0x80    entry_SYSCALL_64_after_hwframe+0x46/0xb0  This can be easily reproduced using:   echo offline \u003e /sys/block/sda/device/state   dd if=/dev/zero of=/dev/mapper/thin bs=4k count=10   dmsetup load pool --table \"0 20971520 thin-pool /dev/sda /dev/sdb 128 0 0\"  If a metadata commit fails, the transaction will be aborted and the metadata space maps will be destroyed. If a DM table reload then happens for this failed thin-pool, a use-after-free will occur in dm_sm_register_threshold_callback (called from dm_pool_register_metadata_threshold).  Fix this by in dm_pool_register_metadata_threshold() by returning the -EINVAL error if the thin-pool is in fail mode. Also fail pool_ctr() with a new error message: \"Error registering metadata threshold\".","modified":"2026-09-01T20:04:57.521383206Z","published":"2025-06-18T11:15:38.383Z","upstream":["CVE-2022-50092"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2022-50092"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50092.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50092.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50092.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}