CVE-2022-50401 in Linux
要約
〜によって VulDB • 2026年05月16日
Linux kernel panic: list_add corruption. next->prev should be prev (ffff89ac4977e538), but was ffff89ac4763e018. (next=ffff89ac4763e018).
This is a **kernel memory corruption bug** in the NFS server (nfsd) subsystem, specifically during callback processing. The crash occurs in `svc_xprt_put()` when trying to free an RPC transport, but the internal doubly-linked list has been corrupted.
### Root Cause Analysis
1. **Corruption Type**: `list_add corruption` indicates that a doubly-linked list (`struct list_head`) has been overwritten. Specifically, the `next` pointer of a list node points to an address that does not correctly link back to its expected `prev` node. 2. **Trigger Point**: The crash happens in `svc_xprt_put()` (called from `nfsd4_process_cb_update()`), which is part of the NFSv4 callback mechanism. 3. **Likely Cause**: * **Use-After-Free (UAF)**: A pointer to an `svc_xprt` structure was freed, but another part of the code still held a reference and tried to access or modify its list node. * **Double-Free**: The same `svc_xprt` was freed twice, corrupting the list when the second free attempted to remove it from the list. * **Race Condition**: Concurrent access to the callback work queue or transport list without proper locking. * **Buffer Overflow**: A nearby buffer overflow overwrote the `list_head` structure within the `svc_xprt` object.
### Affected Components
* **Subsystem**: NFS Server (`nfsd`) * **Specific Code Path**: NFSv4 Callback update processing (`nfsd4_process_cb_update`, `nfsd4_run_cb_work`) * **Kernel Module**: `sunrpc` (RPC transport management)
### Recommended Actions
1. **Update Kernel**: This is likely a known bug that has been fixed in newer kernel versions. Check your distribution's kernel update history for fixes related to: * `nfsd4_process_cb_update` * `svc_xprt_put` * NFSv4 callback race conditions * Look for commits fixing "list corruption in nfsd" or "nfsd callback use-after-free".
2. **Workaround (if applicable)**: * Disable NFSv4 callbacks if not strictly needed: Add `nfsd_callback=0` to the kernel boot parameters or module options for `nfsd`. * Reduce NFS server load or timeout values to minimize race window exposure.
3. **Debugging**: * Enable `CONFIG_DEBUG_LIST` in kernel config to get more detailed list corruption reports. * Enable `CONFIG_SLAB_DEBUG` or `CONFIG_SLUB_DEBUG` to detect use-after-free and double-free issues. * Use `kmemleak` to track memory leaks and dangling pointers. * Analyze the full `dmesg` log for earlier warnings about memory corruption or race conditions.
4. **Report Bug**: If this is a recent kernel version, report the bug to your distribution's bug tracker or the Linux kernel mailing list, including: * Full `dmesg` output * Kernel version (`uname -r`) * Steps to reproduce (if possible) * Configuration details
### Example Fix Commit (Hypothetical)
A typical fix might involve: * Adding proper reference counting (`get`/`put`) for `svc_xprt` objects. * Ensuring all list operations are protected by appropriate locks. * Checking for NULL pointers before list manipulation. * Adding sanity checks in `svc_xprt_put()`.
**Note**: Without access to the specific kernel version and full source code, this is a general analysis. The exact fix depends on the kernel version and the specific code path that introduced the corruption.
If you want to get best quality of vulnerability data, you may have to visit VulDB.