CVE-2022-50676

Source
https://cve.org/CVERecord?id=CVE-2022-50676
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50676.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-50676
Downstream
Related
Published
2025-12-09T01:29:29.166Z
Modified
2026-04-02T08:28:42.130764Z
Summary
net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()
Details

In the Linux kernel, the following vulnerability has been resolved:

net: rds: don't hold sock lock when cancelling work from rdstcpreset_callbacks()

syzbot is reporting lockdep warning at rdstcpresetcallbacks() [1], for commit ac3615e7f3cffe2a ("RDS: TCP: Reduce code duplication in rdstcpresetcallbacks()") added canceldelayedworksync() into a section protected by locksock() without realizing that rdssendxmit() might call lock_sock().

We don't need to protect canceldelayedworksync() using locksock(), for even if rds_{send,recv}_worker() re-queued this work while flushwork() from canceldelayedworksync() was waiting for this work to complete, retried rds{send,recv}worker() is no-op due to the absence of RDSCONNUP bit.

Database specific
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50676.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
ac3615e7f3cffe2a1a6b25172dfd09e138593d82
Fixed
5d2ba255e93211e541373469dffbda7c99dfa0e5
Fixed
2425007c0967a7c04b0dee7cce05ecf0ca869ad1
Fixed
e3cb25d3ad08f5dbd53ce2b31720cad529944322
Fixed
360aa7219285fac63dab99706a16f2daf3222abe
Fixed
da349221c4d2d4ac5f606c1c3b36d4ef0b3e6a0c
Fixed
30bfa5aa7228eb1e67663d67e553627e572cc717
Fixed
c380c28ab9b15fc53565909c814f6dd3e7f77c4b
Fixed
afe7053c390fe8ff27d0c2ceaece5625283044ba
Fixed
a91b750fd6629354460282bbf5146c01b05c4859

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50676.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.8.0
Fixed
4.9.331
Type
ECOSYSTEM
Events
Introduced
4.10.0
Fixed
4.14.296
Type
ECOSYSTEM
Events
Introduced
4.15.0
Fixed
4.19.262
Type
ECOSYSTEM
Events
Introduced
4.20.0
Fixed
5.4.220
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.150
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.75
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
5.19.17
Type
ECOSYSTEM
Events
Introduced
5.20.0
Fixed
6.0.3

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50676.json"