CVE-2022-50441

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-50441
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50441.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-50441
Downstream
Related
Published
2025-10-01T11:42:17Z
Modified
2025-10-21T12:55:47.366631Z
Summary
net/mlx5: Lag, fix failure to cancel delayed bond work
Details

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Lag, fix failure to cancel delayed bond work

Commit 0d4e8ed139d8 ("net/mlx5: Lag, avoid lockdep warnings") accidentally removed a call to cancel delayed bond work thus it may cause queued delay to expire and fall on an already destroyed work queue.

Fix by restoring the call canceldelayedwork_sync() before destroying the workqueue.

This prevents call trace such as this:

[ 329.230417] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 329.231444] #PF: supervisor write access in kernel mode [ 329.232233] #PF: errorcode(0x0002) - not-present page [ 329.233007] PGD 0 P4D 0 [ 329.233476] Oops: 0002 [#1] SMP [ 329.234012] CPU: 5 PID: 145 Comm: kworker/u20:4 Tainted: G OE 6.0.0-rc5mlnx #1 [ 329.235282] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 329.236868] Workqueue: mlx5cmd0000:08:00.1 cmdworkhandler [mlx5core] [ 329.237886] RIP: 0010:rawspinlock+0xc/0x20 [ 329.238585] Code: f0 0f b1 17 75 02 f3 c3 89 c6 e9 6f 3c 5f ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 0f 1f 44 00 00 31 c0 ba 01 00 00 00 <f0> 0f b1 17 75 02 f3 c3 89 c6 e9 45 3c 5f ff 0f 1f 44 00 00 0f 1f [ 329.241156] RSP: 0018:ffffc900001b0e98 EFLAGS: 00010046 [ 329.241940] RAX: 0000000000000000 RBX: ffffffff82374ae0 RCX: 0000000000000000 [ 329.242954] RDX: 0000000000000001 RSI: 0000000000000014 RDI: 0000000000000000 [ 329.243974] RBP: ffff888106ccf000 R08: ffff8881004000c8 R09: ffff888100400000 [ 329.244990] R10: 0000000000000000 R11: ffffffff826669f8 R12: 0000000000002000 [ 329.246009] R13: 0000000000000005 R14: ffff888100aa7ce0 R15: ffff88852ca80000 [ 329.247030] FS: 0000000000000000(0000) GS:ffff88852ca80000(0000) knlGS:0000000000000000 [ 329.248260] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 329.249111] CR2: 0000000000000000 CR3: 000000016d675001 CR4: 0000000000770ee0 [ 329.250133] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 329.251152] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 329.252176] PKRU: 55555554

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
ff24a802204620214afa75a5e64280f40015e399
Fixed
5df57bb04e91add52fb67e226209df9a17f06a89
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0d4e8ed139d871fcb2844dd71075997753baeec8
Fixed
8f1b8b3133504bf9125ee507ddcc3a8fb41a41f0
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0d4e8ed139d871fcb2844dd71075997753baeec8
Fixed
4d1c1379d71777ddeda3e54f8fc26e9ecbfd1009

Affected versions

v6.*

v6.0.13
v6.0.14
v6.0.15
v6.0.16
v6.0.17
v6.0.18
v6.1
v6.1-rc6
v6.1-rc7
v6.1-rc8
v6.1.1
v6.1.2
v6.1.3
v6.1.4

Database specific

vanir_signatures

[
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5df57bb04e91add52fb67e226209df9a17f06a89",
        "target": {
            "function": "mlx5_ldev_free",
            "file": "drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c"
        },
        "deprecated": false,
        "id": "CVE-2022-50441-02521555",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "length": 310.0,
            "function_hash": "181969207898764922175865900951717833842"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f1b8b3133504bf9125ee507ddcc3a8fb41a41f0",
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c"
        },
        "deprecated": false,
        "id": "CVE-2022-50441-1b181e3d",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "275623180205496938303778587710454173896",
                "72452608861455451408213388973637444663",
                "94419376442794060768626648227535619650",
                "236147262198598153562784579277689179647"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4d1c1379d71777ddeda3e54f8fc26e9ecbfd1009",
        "target": {
            "function": "mlx5_ldev_free",
            "file": "drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c"
        },
        "deprecated": false,
        "id": "CVE-2022-50441-1f890a0a",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "length": 310.0,
            "function_hash": "181969207898764922175865900951717833842"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5df57bb04e91add52fb67e226209df9a17f06a89",
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c"
        },
        "deprecated": false,
        "id": "CVE-2022-50441-499f63aa",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "275623180205496938303778587710454173896",
                "72452608861455451408213388973637444663",
                "94419376442794060768626648227535619650",
                "236147262198598153562784579277689179647"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f1b8b3133504bf9125ee507ddcc3a8fb41a41f0",
        "target": {
            "function": "mlx5_ldev_free",
            "file": "drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c"
        },
        "deprecated": false,
        "id": "CVE-2022-50441-566cdb8e",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "length": 310.0,
            "function_hash": "181969207898764922175865900951717833842"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4d1c1379d71777ddeda3e54f8fc26e9ecbfd1009",
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c"
        },
        "deprecated": false,
        "id": "CVE-2022-50441-bd476471",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "275623180205496938303778587710454173896",
                "72452608861455451408213388973637444663",
                "94419376442794060768626648227535619650",
                "236147262198598153562784579277689179647"
            ]
        }
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.0.19
Type
ECOSYSTEM
Events
Introduced
6.1.0
Fixed
6.1.5