CVE catalog

CVE-2022-50240

linux: CVE-2022-50240

Severity: Medium
Published: Jan 1, 2022, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.17% · Oct 25, 2026

In the Linux kernel, the following vulnerability has been resolved: android: binder: stop saving a pointer to the VMA Do not record a pointer to a VMA outside of the mmap_lock for later use. This is unsafe and there are a number of failure paths *after* the recorded VMA pointer may be freed during setup. There is no callback to the driver to clear the saved pointer from generic mm code. Furthermore, the VMA pointer may become stale if any number of VMA operations end up freeing the VMA so saving it was fragile to being with. Instead, change the binder_alloc struct to record the start address of the VMA and use vma_lookup() to get the vma when needed. Add lockdep mmap_lock checks on updates to the vma pointer to ensure the lock is held and depend on that lock for synchronization of readers and writers - which was already the case anyways, so the smp_wmb()/smp_rmb() was not necessary. [akpm@linux-foundation.org: fix drivers/android/binder_alloc_selftest.c]

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	linux	sid	`7.2.12-1`	fixed
Debian	linux	forky	`7.2.12-1`	fixed
Debian	linux	trixie	`6.12.107-1`	fixed
Debian	linux	trixie-security	`6.12.113-1`	fixed
Debian	linux	bookworm	`6.1.176-1`	fixed
Debian	linux	bookworm-security	`6.1.190-1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	linux	source	sid	`5.19.6-1`	not yet assigned	Not reported	Not reported
Debian	linux	source	forky	`5.19.6-1`	not yet assigned	Not reported	Not reported
Debian	linux	source	trixie	`5.19.6-1`	not yet assigned	Not reported	Not reported
Debian	linux	source	bookworm	`5.19.6-1`	not yet assigned	Not reported	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[bpftool]Unknown
Source package: [linux]
Details (6)
- 7.1.0+6.1.176-1 · amd64 · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 7.1.0+6.1.176-1 · arm64 · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 7.5.0+6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 7.5.0+6.12.95-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 7.1.0+6.1.180-1 · amd64 · bookworm-security
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 7.1.0+6.1.180-1 · arm64 · bookworm-security
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
[hyperv-daemons]Unknown
Source package: [linux]
Details (6)
- 6.1.176-1 · amd64 · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.176-1 · arm64 · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · amd64 · bookworm-security
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · arm64 · bookworm-security
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
[intel-sdsi]Unknown
Source package: [linux]
Details (1)
- 6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
[libcpupower1]Unknown
Source package: [linux]
Details (6)
- 6.1.176-1 · amd64 · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.176-1 · arm64 · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · amd64 · bookworm-security
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · arm64 · bookworm-security
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
[libcpupower-dev]Unknown
Source package: [linux]
Details (6)
- 6.1.176-1 · amd64 · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.176-1 · arm64 · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · amd64 · bookworm-security
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · arm64 · bookworm-security
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
[linux-bpf-dev]Unknown
Source package: [linux]
Details (2)
- 6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
[linux-compiler-gcc-12-x86]Unknown
Source package: [linux]
Details (2)
- 6.1.176-1 · amd64 · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · amd64 · bookworm-security
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
[linux-config-6.1]Unknown
Source package: [linux]
Details (4)
- 6.1.176-1 · amd64 · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.176-1 · arm64 · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · amd64 · bookworm-security
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · arm64 · bookworm-security
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
[linux-cpupower]Unknown
Source package: [linux]
Details (6)
- 6.1.176-1 · amd64 · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.176-1 · arm64 · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · amd64 · bookworm-security
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · arm64 · bookworm-security
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
[linux-doc]Unknown
Source package: [linux]
Details (32)
- 6.1.170-3 · all · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.170-3 · all · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.176-1 · all · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.176-1 · all · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.43-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.43-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.57-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.57-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.63-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.63-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.69-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.69-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.73-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.73-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.74-2~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.74-2~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.85-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.85-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.86-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.86-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.88-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.88-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.90-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.90-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.90-2~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.90-2~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.94-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.94-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · all · bookworm-security
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · all · bookworm-security
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
[linux-doc-6.1]Unknown
Source package: [linux]
Details (6)
- 6.1.170-3 · all · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.170-3 · all · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.176-1 · all · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.176-1 · all · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · all · bookworm-security
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.180-1 · all · bookworm-security
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-47-amd64]Unknown
Source package: [linux]
Details (1)
- 6.1.170-3 · amd64 · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-47-arm64]Unknown
Source package: [linux]
Details (1)
- 6.1.170-3 · arm64 · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-47-cloud-amd64]Unknown
Source package: [linux]
Details (1)
- 6.1.170-3 · amd64 · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-47-cloud-arm64]Unknown
Source package: [linux]
Details (1)
- 6.1.170-3 · arm64 · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-47-common]Unknown
Source package: [linux]
Details (2)
- 6.1.170-3 · all · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.170-3 · all · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-47-common-rt]Unknown
Source package: [linux]
Details (2)
- 6.1.170-3 · all · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
- 6.1.170-3 · all · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-47-rt-amd64]Unknown
Source package: [linux]
Details (1)
- 6.1.170-3 · amd64 · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-47-rt-arm64]Unknown
Source package: [linux]
Details (1)
- 6.1.170-3 · arm64 · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm
[linux-headers-6.1.0-50-amd64]Unknown
Source package: [linux]
Details (1)
- 6.1.176-1 · amd64 · bookworm
  Fixed · Fixed: 5.19.6-1
  dsa · linux · debian · bookworm

Next results

Observed: Oct 26, 2026, 8:49:42 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [Red Hat security advisories and VEX]