CVE-2022-50354

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-50354
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50354.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-50354
Downstream
Related
Published
2025-09-17T14:56:07.596Z
Modified
2026-03-11T11:10:27.339707Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
drm/amdkfd: Fix kfd_process_device_init_vm error handling
Details

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix kfdprocessdeviceinitvm error handling

Should only destroy the ib_mem and let process cleanup worker to free the outstanding BOs. Reset the pointer in pdd->qpd structure, to avoid NULL pointer access in process destroy worker.

BUG: kernel NULL pointer dereference, address: 0000000000000010 Call Trace: amdgpuamdkfdgpuvmunmapgttbofromkernel+0x46/0xb0 [amdgpu] kfdprocessdevicedestroycwsrdgpu+0x40/0x70 [amdgpu] kfdprocessdestroypdds+0x71/0x190 [amdgpu] kfdprocesswqrelease+0x2a2/0x3b0 [amdgpu] processonework+0x2a1/0x600 worker_thread+0x39/0x3d0

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50354.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
68df0f195a689bbb0f92bfeadee6edd90c79c31f
Fixed
b6e78bd3bf2eb964c95eb2596d3cd367307a20b5
Fixed
9d74d1f52e16d8e07f7fbe52e96d6391418a2fe9
Fixed
29d48b87db64b6697ddad007548e51d032081c59

Affected versions

v5.*
v5.15
v5.16
v5.16-rc1
v5.16-rc2
v5.16-rc3
v5.16-rc4
v5.16-rc5
v5.16-rc6
v5.16-rc7
v5.16-rc8
v5.17
v5.17-rc1
v5.17-rc2
v5.17-rc3
v5.17-rc4
v5.17-rc5
v5.17-rc6
v5.17-rc7
v5.17-rc8
v5.18
v5.18-rc1
v5.18-rc2
v5.18-rc3
v5.18-rc4
v5.18-rc5
v5.18-rc6
v5.18-rc7
v5.19
v5.19-rc1
v5.19-rc2
v5.19-rc3
v5.19-rc4
v5.19-rc5
v5.19-rc6
v5.19-rc7
v5.19-rc8
v6.*
v6.0
v6.0-rc1
v6.0-rc2
v6.0-rc3
v6.0-rc4
v6.0-rc5
v6.0-rc6
v6.0-rc7
v6.0.1
v6.0.10
v6.0.11
v6.0.12
v6.0.13
v6.0.14
v6.0.15
v6.0.16
v6.0.17
v6.0.18
v6.0.2
v6.0.3
v6.0.4
v6.0.5
v6.0.6
v6.0.7
v6.0.8
v6.0.9
v6.1
v6.1-rc1
v6.1-rc2
v6.1-rc3
v6.1-rc4
v6.1-rc5
v6.1-rc6
v6.1-rc7
v6.1-rc8
v6.1.1
v6.1.2
v6.1.3
v6.1.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50354.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "228945775996811627002191656239621480532",
            "length": 732.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6e78bd3bf2eb964c95eb2596d3cd367307a20b5",
        "signature_type": "Function",
        "id": "CVE-2022-50354-0204d3d9",
        "target": {
            "file": "drivers/gpu/drm/amd/amdkfd/kfd_process.c",
            "function": "kfd_process_device_init_vm"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "296318703954592349495129531812702266796",
                "298050800774317400872746281353391303017",
                "174251772193292016188756456152860468790",
                "242425672258612182058257861924684844475",
                "174913120620295843478665618865879879963",
                "227475517956110328317685222841120785134",
                "300167964448145915322930739612908871916",
                "249925024762551355884273774703972607908",
                "292823628447844896557163160509671753913",
                "71216980553743778919263858461135516397",
                "222936118666398358926594347203798279658",
                "13552321776412638165493392791301395020",
                "25759530819101918006822335516134786541",
                "53890665151025136305346349404945733988",
                "222059323927971603352005324952895947301",
                "140326736460187399943707562950264199745",
                "260594964817279298339382979031318513869",
                "257560424343669480806791839042194348690",
                "93563591752340367617893982350651236091",
                "161048600645645327422477055003910483565",
                "244783995495850961210845652231556359277",
                "100894621157762029716124193406325633480",
                "33777185167746783625498675480316047146"
            ]
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9d74d1f52e16d8e07f7fbe52e96d6391418a2fe9",
        "signature_type": "Line",
        "id": "CVE-2022-50354-374222b3",
        "target": {
            "file": "drivers/gpu/drm/amd/amdkfd/kfd_process.c"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "261432062052991207774025394824512352632",
            "length": 183.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@29d48b87db64b6697ddad007548e51d032081c59",
        "signature_type": "Function",
        "id": "CVE-2022-50354-390b1b78",
        "target": {
            "file": "drivers/gpu/drm/amd/amdkfd/kfd_process.c",
            "function": "kfd_process_device_destroy_ib_mem"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "228945775996811627002191656239621480532",
            "length": 732.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9d74d1f52e16d8e07f7fbe52e96d6391418a2fe9",
        "signature_type": "Function",
        "id": "CVE-2022-50354-3b0ef0de",
        "target": {
            "file": "drivers/gpu/drm/amd/amdkfd/kfd_process.c",
            "function": "kfd_process_device_init_vm"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "228945775996811627002191656239621480532",
            "length": 732.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@29d48b87db64b6697ddad007548e51d032081c59",
        "signature_type": "Function",
        "id": "CVE-2022-50354-66957581",
        "target": {
            "file": "drivers/gpu/drm/amd/amdkfd/kfd_process.c",
            "function": "kfd_process_device_init_vm"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "296318703954592349495129531812702266796",
                "298050800774317400872746281353391303017",
                "174251772193292016188756456152860468790",
                "242425672258612182058257861924684844475",
                "174913120620295843478665618865879879963",
                "227475517956110328317685222841120785134",
                "300167964448145915322930739612908871916",
                "249925024762551355884273774703972607908",
                "292823628447844896557163160509671753913",
                "71216980553743778919263858461135516397",
                "222936118666398358926594347203798279658",
                "13552321776412638165493392791301395020",
                "25759530819101918006822335516134786541",
                "53890665151025136305346349404945733988",
                "222059323927971603352005324952895947301",
                "140326736460187399943707562950264199745",
                "260594964817279298339382979031318513869",
                "257560424343669480806791839042194348690",
                "93563591752340367617893982350651236091",
                "161048600645645327422477055003910483565",
                "244783995495850961210845652231556359277",
                "100894621157762029716124193406325633480",
                "33777185167746783625498675480316047146"
            ]
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@29d48b87db64b6697ddad007548e51d032081c59",
        "signature_type": "Line",
        "id": "CVE-2022-50354-6be17da5",
        "target": {
            "file": "drivers/gpu/drm/amd/amdkfd/kfd_process.c"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "26502166578271570515229369839831531077",
            "length": 274.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@29d48b87db64b6697ddad007548e51d032081c59",
        "signature_type": "Function",
        "id": "CVE-2022-50354-701f1676",
        "target": {
            "file": "drivers/gpu/drm/amd/amdkfd/kfd_process.c",
            "function": "kfd_process_free_gpuvm"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "247856395348070571562351047818825310777",
            "length": 245.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6e78bd3bf2eb964c95eb2596d3cd367307a20b5",
        "signature_type": "Function",
        "id": "CVE-2022-50354-9523242e",
        "target": {
            "file": "drivers/gpu/drm/amd/amdkfd/kfd_process.c",
            "function": "kfd_process_device_destroy_cwsr_dgpu"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "296318703954592349495129531812702266796",
                "298050800774317400872746281353391303017",
                "174251772193292016188756456152860468790",
                "242425672258612182058257861924684844475",
                "174913120620295843478665618865879879963",
                "227475517956110328317685222841120785134",
                "300167964448145915322930739612908871916",
                "249925024762551355884273774703972607908",
                "292823628447844896557163160509671753913",
                "71216980553743778919263858461135516397",
                "222936118666398358926594347203798279658",
                "13552321776412638165493392791301395020",
                "25759530819101918006822335516134786541",
                "53890665151025136305346349404945733988",
                "222059323927971603352005324952895947301",
                "140326736460187399943707562950264199745",
                "260594964817279298339382979031318513869",
                "257560424343669480806791839042194348690",
                "93563591752340367617893982350651236091",
                "161048600645645327422477055003910483565",
                "244783995495850961210845652231556359277",
                "100894621157762029716124193406325633480",
                "33777185167746783625498675480316047146"
            ]
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6e78bd3bf2eb964c95eb2596d3cd367307a20b5",
        "signature_type": "Line",
        "id": "CVE-2022-50354-99067e30",
        "target": {
            "file": "drivers/gpu/drm/amd/amdkfd/kfd_process.c"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "261432062052991207774025394824512352632",
            "length": 183.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6e78bd3bf2eb964c95eb2596d3cd367307a20b5",
        "signature_type": "Function",
        "id": "CVE-2022-50354-d0de9b02",
        "target": {
            "file": "drivers/gpu/drm/amd/amdkfd/kfd_process.c",
            "function": "kfd_process_device_destroy_ib_mem"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "247856395348070571562351047818825310777",
            "length": 245.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9d74d1f52e16d8e07f7fbe52e96d6391418a2fe9",
        "signature_type": "Function",
        "id": "CVE-2022-50354-d657fbc7",
        "target": {
            "file": "drivers/gpu/drm/amd/amdkfd/kfd_process.c",
            "function": "kfd_process_device_destroy_cwsr_dgpu"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "247856395348070571562351047818825310777",
            "length": 245.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@29d48b87db64b6697ddad007548e51d032081c59",
        "signature_type": "Function",
        "id": "CVE-2022-50354-d6ac7356",
        "target": {
            "file": "drivers/gpu/drm/amd/amdkfd/kfd_process.c",
            "function": "kfd_process_device_destroy_cwsr_dgpu"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "26502166578271570515229369839831531077",
            "length": 274.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6e78bd3bf2eb964c95eb2596d3cd367307a20b5",
        "signature_type": "Function",
        "id": "CVE-2022-50354-f13363b3",
        "target": {
            "file": "drivers/gpu/drm/amd/amdkfd/kfd_process.c",
            "function": "kfd_process_free_gpuvm"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "26502166578271570515229369839831531077",
            "length": 274.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9d74d1f52e16d8e07f7fbe52e96d6391418a2fe9",
        "signature_type": "Function",
        "id": "CVE-2022-50354-f6d9838e",
        "target": {
            "file": "drivers/gpu/drm/amd/amdkfd/kfd_process.c",
            "function": "kfd_process_free_gpuvm"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "261432062052991207774025394824512352632",
            "length": 183.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9d74d1f52e16d8e07f7fbe52e96d6391418a2fe9",
        "signature_type": "Function",
        "id": "CVE-2022-50354-fd27c59b",
        "target": {
            "file": "drivers/gpu/drm/amd/amdkfd/kfd_process.c",
            "function": "kfd_process_device_destroy_ib_mem"
        }
    }
]