CVE-2022-50401 in Linux
Tóm tắt
Bởi VulDB • 31/05/2026
Trong the kernel log you provided, the critical error is:
``` list_add corruption. next->prev should be prev (ffff89ac4977e538), but was ffff89ac4763e018. (next=ffff89ac4763e018). ```
This is a **list corruption bug** in the Linux kernel, specifically within the **NFS server (nfsd)** subsystem.
---
### ???? Breakdown of the Error
#### 1. **What is `list_add corruption`?** - The Linux kernel uses doubly-linked lists (`struct list_head`) extensively. - `list_add()` inserts a new element into a list. - If the list pointers (`next` and `prev`) are inconsistent, it means: - Memory was corrupted. - A list element was freed but still referenced. - A race condition caused concurrent modifications without proper locking. - A bug in the code that manipulates the list.
#### 2. **Call Trace Analysis** ``` svc_xprt_put+0xaf/0xe0 [sunrpc]
nfsd4_process_cb_update.isra.11+0xb7/0x410 [nfsd]
nfsd4_run_cb_work+0xfc/0x270 [nfsd]
process_one_work+0x1df/0x390 worker_thread+0x37/0x3b0 kthread+0x12f/0x150 ```
- The crash occurs in **`svc_xprt_put()`**, which is part of the **SUNRPC** subsystem. - It is called from **`nfsd4_process_cb_update()`**, which handles **NFSv4 callback updates**. - This is executed in a **workqueue** (`nfsd4_run_cb_work`), meaning it’s asynchronous.
#### 3. **Root Cause Hypothesis** The most likely causes are:
##### ✅ **Use-After-Free or Double-Free** - An `svc_xprt` (RPC transport) structure was freed, but its list node was still being accessed or modified. - This can happen if: - The transport is destroyed while a callback is still pending. - The callback work item references a freed `svc_xprt`.
##### ✅ **Race Condition** - Multiple threads (e.g., callback worker and transport cleanup) modify the same list without proper synchronization. - The `svc_xprt` list is protected by a lock, but if the lock is not held correctly during `list_add` or `list_del`, corruption occurs.
##### ✅ **Memory Corruption** - Heap corruption (e.g., buffer overflow, slab corruption) overwrites list pointers. - This is less common but possible if there’s a bug elsewhere in the kernel or driver.
---
### ????️ How to Debug Further
#### 1. **Enable Kernel Debugging Options** Recompile the kernel with: ```bash CONFIG_DEBUG_LIST=y CONFIG_SLAB_DEBUG=y CONFIG_KASAN=y # Kernel Address Sanitizer ``` - `CONFIG_DEBUG_LIST` will catch list corruption earlier and provide more details. - `CONFIG_KASAN` can detect use-after-free and buffer overflows.
#### 2. **Check for Known Bugs** - Search for this issue in the **Linux kernel bugzilla** or **lore.kernel.org**. - Keywords: `nfsd list_add corruption`, `svc_xprt_put list corruption`, `nfsd4_process_cb_update`.
#### 3. **Update Kernel** - This may be a known bug fixed in newer kernel versions. - Check if your kernel version is affected. For example: - Kernel **5.15+** has many NFS server fixes. - Look for commits related to `nfsd` and `svc_xprt`.
#### 4. **Reproduce the Issue** - Try to reproduce the crash with: - High load on NFS server. - Many concurrent NFSv4 clients. - Callback-heavy operations (e.g., delegation recalls).
#### 5. **Check dmesg for Earlier Warnings** - Look for: - `BUG: unable to handle kernel paging request` - `slab corruption` - `WARNING: CPU: X PID: Y at lib/list_debug.c` - These can provide clues about the root cause.
---
### ???? Summary
| Aspect | Detail | |--------|--------| | **Error** | `list_add corruption` in `svc_xprt_put()` | | **Subsystem** | NFS server (`
If you want to get the best quality for vulnerability data then you always have to consider VulDB.