Log in Start free

Vulnerability · Published Sep 18, 2025 · Assigned by Linux

CVE-2022-50388nvme: fix multipath crash caused by flush request when blktrace is enabled

Medium 5.5

In plain English

A medium-severity null pointer dereference in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 94.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: nvme: fix multipath crash caused by flush request when blktrace is enabled The flush request initialized by blk_kick_flush has NULL bio, and it may be dealt with nvme_end_req during io completion. When blktrace is enabled, nvme_trace_bio_complete with multipath activated trying to access NULL pointer bio from flush request results in the following crash: [ 2517.831677] BUG: kernel NULL pointer dereference, address: 000000000000001a [ 2517.835213] #PF: supervisor read access in kernel mode [ 2517.838724] #PF: error_code(0x0000) - not-present page [ 2517.842222] PGD 7b2d51067 P4D 0 [ 2517.845684] Oops: 0000 [#1] SMP NOPTI [ 2517.849125] CPU: 2 PID: 732 Comm: kworker/2:1H Kdump: loaded Tainted: G S 5.15.67-0.cl9.x86_64 #1 [ 2517.852723] Hardware name: XFUSION 2288H V6/BC13MBSBC, BIOS 1.13 07/27/2022 [ 2517.856358] Workqueue: nvme_tcp_wq nvme_tcp_io_work [nvme_tcp] [ 2517.859993] RIP: 0010:blk_add_trace_bio_complete+0x6/0x30 [ 2517.863628] Code: 1f 44 00 00 48 8b 46 08 31 c9 ba 04 00 10 00 48 8b 80 50 03 00 00 48 8b 78 50 e9 e5 fe ff ff 0f 1f 44 00 00 41 54 49 89 f4 55 <0f> b6 7a 1a 48 89 d5 e8 3e 1c 2b 00 48 89 ee 4c 89 e7 5d 89 c1 ba [ 2517.871269] RSP: 0018:ff7f6a008d9dbcd0 EFLAGS: 00010286 [ 2517.875081] RAX: ff3d5b4be00b1d50 RBX: 0000000002040002 RCX: ff3d5b0a270f2000 [ 2517.878966] RDX: 0000000000000000 RSI: ff3d5b0b021fb9f8 RDI: 0000000000000000 [ 2517.882849] RBP: ff3d5b0b96a6fa00 R08: 0000000000000001 R09: 0000000000000000 [ 2517.886718] R10: 000000000000000c R11: 000000000000000c R12: ff3d5b0b021fb9f8 [ 2517.890575] R13: 0000000002000000 R14: ff3d5b0b021fb1b0 R15: 0000000000000018 [ 2517.894434] FS: 0000000000000000(0000) GS:ff3d5b42bfc80000(0000) knlGS:0000000000000000 [ 2517.898299] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2517.902157] CR2: 000000000000001a CR3: 00000004f023e005 CR4: 0000000000771ee0 [ 2517.906053] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 2517.909930] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 2517.913761] PKRU: 55555554 [ 2517.917558] Call Trace: [ 2517.921294] <TASK> [ 2517.924982] nvme_complete_rq+0x1c3/0x1e0 [nvme_core] [ 2517.928715] nvme_tcp_recv_pdu+0x4d7/0x540 [nvme_tcp] [ 2517.932442] nvme_tcp_recv_skb+0x4f/0x240 [nvme_tcp] [ 2517.936137] ? nvme_tcp_recv_pdu+0x540/0x540 [nvme_tcp] [ 2517.939830] tcp_read_sock+0x9c/0x260 [ 2517.943486] nvme_tcp_try_recv+0x65/0xa0 [nvme_tcp] [ 2517.947173] nvme_tcp_io_work+0x64/0x90 [nvme_tcp] [ 2517.950834] process_one_work+0x1e8/0x390 [ 2517.954473] worker_thread+0x53/0x3c0 [ 2517.958069] ? process_one_work+0x390/0x390 [ 2517.961655] kthread+0x10c/0x130 [ 2517.965211] ? set_kthread_struct+0x40/0x40 [ 2517.968760] ret_from_fork+0x1f/0x30 [ 2517.972285] </TASK> To avoid this situation, add a NULL check for req->bio before calling trace_block_bio_complete.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.7-1DEBIAN-CVE-2022-50388
Debian:13linux6.1.7-1DEBIAN-CVE-2022-50388
Debian:14linux6.1.7-1DEBIAN-CVE-2022-50388
Ubuntu:22.04:LTSlinux5.15.0-69.76UBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-aws5.15.0-1033.37UBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-azure5.15.0-1035.42UBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2022-50388
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1035.42.1UBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-gcp5.15.0-1031.38UBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2022-50388
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-gke5.15.0-1030.35UBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1017.22UBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2022-50388
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-ibm5.15.0-1027.30UBUNTU-CVE-2022-50388
Ubuntu:24.04:LTSlinux-intelno fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1027.32UBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-kvm5.15.0-1030.35UBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-69.76UBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2022-50388
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1023.23UBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2022-50388
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2022-50388
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-oracle5.15.0-1032.38UBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-raspi5.15.0-1026.28UBUNTU-CVE-2022-50388
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-50388
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-50388
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2022-50388
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2022-50388

Affected products (as reported)

VendorProductVersions
Linux Linux 35fe0d12c8a3d5e45f297562732ddc9ba9dc58dd – before f13301a69ababa6c2236fb4f0393b7e914e7e1e035fe0d12c8a3d5e45f297562732ddc9ba9dc58dd – before 4df413d46960f11c8c105238cfc3f5ff4c95c00335fe0d12c8a3d5e45f297562732ddc9ba9dc58dd – before fcd2d199486033223e9b2a6a7f9a01dd0327eac335fe0d12c8a3d5e45f297562732ddc9ba9dc58dd – before 183c2aaef40a91acbaae45c3824d6cde7bb62b1035fe0d12c8a3d5e45f297562732ddc9ba9dc58dd – before 3659fb5ac29a5e6102bebe494ac789fd47fb78f4
Linux Linux 5.4

Weakness: CWE-476 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References