{
  "cveId": "CVE-2022-50174",
  "url": "https://patchblox.com/security/cve/CVE-2022-50174",
  "summary": "CVE-2022-50174 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-50174, released June 18, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  net: hinic: avoid kernel hung in hinic_get_stats...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  net: hinic: avoid kernel hung in hinic_get_stats64()  When using hinic device as a bond slave device, and reading device stats of master bond device, the kernel may hung.  The kernel panic calltrace as follows: Kernel panic - not syncing: softlockup: hung tasks Call trace:   native_queued_spin_lock_slowpath\u002B0x1ec/0x31c   dev_get_stats\u002B0x60/0xcc   dev_seq_printf_stats\u002B0x40/0x120   dev_seq_show\u002B0x1c/0x40   seq_read_iter\u002B0x3c8/0x4dc   seq_read\u002B0xe0/0x130   proc_reg_read\u002B0xa8/0xe0   vfs_read\u002B0xb0/0x1d4   ksys_read\u002B0x70/0xfc   __arm64_sys_read\u002B0x20/0x30   el0_svc_common\u002B0x88/0x234   do_el0_svc\u002B0x2c/0x90   el0_svc\u002B0x1c/0x30   el0_sync_handler\u002B0xa8/0xb0   el0_sync\u002B0x148/0x180  And the calltrace of task that actually caused kernel hungs as follows:   __switch_to\u002B124   __schedule\u002B548   schedule\u002B72   schedule_timeout\u002B348   __down_common\u002B188   __down\u002B24   down\u002B104   hinic_get_stats64\u002B44 [hinic]   dev_get_stats\u002B92   bond_get_stats\u002B172 [bonding]   dev_get_stats\u002B92   dev_seq_printf_stats\u002B60   dev_seq_show\u002B24   seq_read_iter\u002B964   seq_read\u002B220   proc_reg_read\u002B164   vfs_read\u002B172   ksys_read\u002B108   __arm64_sys_read\u002B28   el0_svc_common\u002B132   do_el0_svc\u002B40   el0_svc\u002B24   el0_sync_handler\u002B164   el0_sync\u002B324  When getting device stats from bond, kernel will call bond_get_stats(). It first holds the spinlock bond-\u003Estats_lock, and then call hinic_get_stats64() to collect hinic device\u0027s stats. However, hinic_get_stats64() calls \u0060down(\u0026nic_dev-\u003Emgmt_lock)\u0060 to protect its critical section, which may schedule current task out. And if system is under high pressure, the task cannot be woken up immediately, which eventually triggers kernel hung panic.  Since previous patch has replaced hinic_dev.tx_stats/rx_stats with local variable in hinic_get_stats64(), there is nothing need to be protected by lock, so just removing down()/up() is ok.",
  "published": "2025-06-18T11:15:47Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00186,
  "epssPercentile": 0.08247,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.0.2-1",
      "fix": "DEBIAN-CVE-2022-50174",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50174",
      "released": "2025-06-18T11:15:47Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.0.2-1",
      "fix": "DEBIAN-CVE-2022-50174",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50174",
      "released": "2025-06-18T11:15:47Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.0.2-1",
      "fix": "DEBIAN-CVE-2022-50174",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50174",
      "released": "2025-06-18T11:15:47Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}