{
  "cveId": "CVE-2022-50008",
  "url": "https://patchblox.com/security/cve/CVE-2022-50008",
  "summary": "CVE-2022-50008 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-50008, released June 18, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  kprobes: don\u0027t call disarm_kprobe() for disabled...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  kprobes: don\u0027t call disarm_kprobe() for disabled kprobes  The assumption in __disable_kprobe() is wrong, and it could try to disarm an already disarmed kprobe and fire the WARN_ONCE() below. [0]  We can easily reproduce this issue.  1. Write 0 to /sys/kernel/debug/kprobes/enabled.    # echo 0 \u003E /sys/kernel/debug/kprobes/enabled  2. Run execsnoop.  At this time, one kprobe is disabled.    # /usr/share/bcc/tools/execsnoop \u0026   [1] 2460   PCOMM            PID    PPID   RET ARGS    # cat /sys/kernel/debug/kprobes/list   ffffffff91345650  r  __x64_sys_execve\u002B0x0    [FTRACE]   ffffffff91345650  k  __x64_sys_execve\u002B0x0    [DISABLED][FTRACE]  3. Write 1 to /sys/kernel/debug/kprobes/enabled, which changes    kprobes_all_disarmed to false but does not arm the disabled kprobe.    # echo 1 \u003E /sys/kernel/debug/kprobes/enabled    # cat /sys/kernel/debug/kprobes/list   ffffffff91345650  r  __x64_sys_execve\u002B0x0    [FTRACE]   ffffffff91345650  k  __x64_sys_execve\u002B0x0    [DISABLED][FTRACE]  4. Kill execsnoop, when __disable_kprobe() calls disarm_kprobe() for the    disabled kprobe and hits the WARN_ONCE() in __disarm_kprobe_ftrace().    # fg   /usr/share/bcc/tools/execsnoop   ^C  Actually, WARN_ONCE() is fired twice, and __unregister_kprobe_top() misses some cleanups and leaves the aggregated kprobe in the hash table.  Then, __unregister_trace_kprobe() initialises tk-\u003Erp.kp.list and creates an infinite loop like this.    aggregated kprobe.list -\u003E kprobe.list -.                                      ^    |                                      \u0027.__.\u0027  In this situation, these commands fall into the infinite loop and result in RCU stall or soft lockup.    cat /sys/kernel/debug/kprobes/list : show_kprobe_addr() enters into the                                        infinite loop with RCU.    /usr/share/bcc/tools/execsnoop : warn_kprobe_rereg() holds kprobe_mutex,                                    and __get_valid_kprobe() is stuck in \t\t\t\t   the loop.  To avoid the issue, make sure we don\u0027t call disarm_kprobe() for disabled kprobes.  [0] Failed to disarm kprobe-ftrace at __x64_sys_execve\u002B0x0/0x40 (error -2) WARNING: CPU: 6 PID: 2460 at kernel/kprobes.c:1130 __disarm_kprobe_ftrace.isra.19 (kernel/kprobes.c:1129) Modules linked in: ena CPU: 6 PID: 2460 Comm: execsnoop Not tainted 5.19.0\u002B #28 Hardware name: Amazon EC2 c5.2xlarge/, BIOS 1.0 10/16/2017 RIP: 0010:__disarm_kprobe_ftrace.isra.19 (kernel/kprobes.c:1129) Code: 24 8b 02 eb c1 80 3d c4 83 f2 01 00 75 d4 48 8b 75 00 89 c2 48 c7 c7 90 fa 0f 92 89 04 24 c6 05 ab 83 01 e8 e4 94 f0 ff \u003C0f\u003E 0b 8b 04 24 eb b1 89 c6 48 c7 c7 60 fa 0f 92 89 04 24 e8 cc 94 RSP: 0018:ffff9e6ec154bd98 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffffff930f7b00 RCX: 0000000000000001 RDX: 0000000080000001 RSI: ffffffff921461c5 RDI: 00000000ffffffff RBP: ffff89c504286da8 R08: 0000000000000000 R09: c0000000fffeffff R10: 0000000000000000 R11: ffff9e6ec154bc28 R12: ffff89c502394e40 R13: ffff89c502394c00 R14: ffff9e6ec154bc00 R15: 0000000000000000 FS:  00007fe800398740(0000) GS:ffff89c812d80000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000c00057f010 CR3: 0000000103b54006 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: \u003CTASK\u003E  __disable_kprobe (kernel/kprobes.c:1716)  disable_kprobe (kernel/kprobes.c:2392)  __disable_trace_kprobe (kernel/trace/trace_kprobe.c:340)  disable_trace_kprobe (kernel/trace/trace_kprobe.c:429)  perf_trace_event_unreg.isra.2 (./include/linux/tracepoint.h:93 kernel/trace/trace_event_perf.c:168)  perf_kprobe_destroy (kernel/trace/trace_event_perf.c:295)  _free_event (kernel/events/core.c:4971)  perf_event_release_kernel (kernel/events/core.c:5176)  perf_release (kernel/events/core.c:5186)  __fput (fs/file_table.c:321)  task_work_run (./include/linux/ ---truncated---",
  "published": "2025-06-18T11:15:28Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00253,
  "epssPercentile": 0.16936,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.0.2-1",
      "fix": "DEBIAN-CVE-2022-50008",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50008",
      "released": "2025-06-18T11:15:28Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.0.2-1",
      "fix": "DEBIAN-CVE-2022-50008",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50008",
      "released": "2025-06-18T11:15:28Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.0.2-1",
      "fix": "DEBIAN-CVE-2022-50008",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50008",
      "released": "2025-06-18T11:15:28Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}