CVE-2022-50215

Local data corruption via premature ENODEV response

Published Jun 18, 2025 · Updated Aug 5, 2026

Memory corruption in the Linux kernel sg driver allows local users to corrupt process memory or device-bound data during SCSI removal. The sg read-wait path returns ENODEV immediately after device removal even while an SG_FLAG_DIRECT_IO command still owns the userspace buffer. Exploitation requires a direct-I/O sg command to remain active as its SCSI device is removed; READ operations corrupt userspace memory, while WRITE operations can send corrupted data to the device.

CVSS severity7.8
High
EPSS probability0.23%
Next 30 days · Sep 16, 2026
Known exploitationUnconfirmed
Based on sourced intelligence
Hinoki checkNot available
Coverage for this vulnerability

See if you're affected

Explore vulnerability checks for your environment with Hinoki.

Book a demo

Summary

What happened

Memory corruption in the Linux kernel sg driver allows local users to corrupt process memory or device-bound data during SCSI removal. The sg read-wait path returns ENODEV immediately after device removal even while an SG_FLAG_DIRECT_IO command still owns the userspace buffer. Exploitation requires a direct-I/O sg command to remain active as its SCSI device is removed; READ operations corrupt userspace memory, while WRITE operations can send corrupted data to the device.

The record

CVE
CVE-2022-50215
Published
Jun 18, 2025
Updated
Aug 5, 2026
Vendor
The Linux Kernel Organization
Product
Linux
Classifications
Unavailable
Attack vector
local
Privileges
authenticated

Timeline

How it unfolded

  1. Jun 18, 2025CVE publishedPublication date reported by the CVE source.
  2. Aug 5, 2026Record updatedLatest update available in the CVE record.

Exploitability

Present is not the same as exploitable

Compare your product and version with the public record. A matching version still requires validation against your environment.

Is a vulnerable build present?

Compare these published version ranges with your installed build and any vendor patches.

  1. Affected versionversion=2.6.28.10 <2.6.29
  2. Affected versionversion=2.6.29.2 <2.6.30
  3. Affected versionversion=2.6.30
  4. Affected versionversion=a0fe972f78eaaf352d593f9ed9079de590ceb286
  5. Affected versionversion=b21c6d2897cd455fa396f4041a0c8165784e949f
  6. Affected versionversion=c6517b7942fad663cc1cf3235cbe4207cf769332 <03d8241112d5e3cccce1a01274a221099f07d2e1
  7. Affected versionversion=c6517b7942fad663cc1cf3235cbe4207cf769332 <3455607fd7be10b449f5135c00dc306b85dc0d21
  8. Affected versionversion=c6517b7942fad663cc1cf3235cbe4207cf769332 <35e60ec39e862159cb92923eefd5230d4a873cb9
  9. Affected versionversion=c6517b7942fad663cc1cf3235cbe4207cf769332 <408bfa1489a3cfe7150b81ab0b0df99b23dd5411
  10. Affected versionversion=c6517b7942fad663cc1cf3235cbe4207cf769332 <8c004b7dbb340c1e5889f5fb9e5baa6f6e5303e8
  11. Affected versionversion=c6517b7942fad663cc1cf3235cbe4207cf769332 <bbc118acf7baf9e93c5e1314d14f481301af4d0f
  12. Affected versionversion=c6517b7942fad663cc1cf3235cbe4207cf769332 <ed9afd967cbfe7da2dc0d5e52c62a778dfe9f16b
  13. Affected versionversion=c6517b7942fad663cc1cf3235cbe4207cf769332 <f135c65085eed869d10e4e7923ce1015288618da
  14. Affected versionversion=c6517b7942fad663cc1cf3235cbe4207cf769332 <f5e61d9b4a699dd16f32d5f39eb1cf98d84c92ed

What conditions does exploitation require?

Attack vectorlocal
Required privilegesauthenticated

What is affected?

The Linux Kernel Organization · Linuxversion=2.6.28.10 <2.6.29; version=2.6.29.2 <2.6.30; version=2.6.30; version=a0fe972f78eaaf352d593f9ed9079de590ceb286; version=b21c6d2897cd455fa396f4041a0c8165784e949f; version=c6517b7942fad663cc1cf3235cbe4207cf769332 <03d8241112d5e3cccce1a01274a221099f07d2e1; version=c6517b7942fad663cc1cf3235cbe4207cf769332 <3455607fd7be10b449f5135c00dc306b85dc0d21; version=c6517b7942fad663cc1cf3235cbe4207cf769332 <35e60ec39e862159cb92923eefd5230d4a873cb9; version=c6517b7942fad663cc1cf3235cbe4207cf769332 <408bfa1489a3cfe7150b81ab0b0df99b23dd5411; version=c6517b7942fad663cc1cf3235cbe4207cf769332 <8c004b7dbb340c1e5889f5fb9e5baa6f6e5303e8; version=c6517b7942fad663cc1cf3235cbe4207cf769332 <bbc118acf7baf9e93c5e1314d14f481301af4d0f; version=c6517b7942fad663cc1cf3235cbe4207cf769332 <ed9afd967cbfe7da2dc0d5e52c62a778dfe9f16b; version=c6517b7942fad663cc1cf3235cbe4207cf769332 <f135c65085eed869d10e4e7923ce1015288618da; version=c6517b7942fad663cc1cf3235cbe4207cf769332 <f5e61d9b4a699dd16f32d5f39eb1cf98d84c92ed

Published CVSS scores

5.5NIST NVDCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
7.8kernel.orgCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS describes severity. EPSS estimates exploitation probability.

Attacks

What attackers are doing with it

Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.

Daily unique IPsNo honeypot observations are available for this CVE in the selected window.

No observations available

Sep 9, 2026Sep 15, 2026
Latest reporting daySep 15, 2026
Latest daily unique IPsUnavailable
Prior 30-day averageUnavailable
SourceShadowserver honeypots (KEV)
Vectorlocal
Privilegesauthenticated
Known exploitationUnconfirmed
Public exploitUnconfirmed

Weakness, pattern, technique

No sourced classifications are available.

Public exploit references

No public exploit references are available in this record.

Labels summarize the accepted research assessment. They do not indicate a test against your environment.

Technologies

Your stack

See the directory against your own environment.

Your stack

Check the software in your environment

Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.

Book a demo