GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50426 (GCVE-0-2022-50426)

Vulnerability from cvelistv5 – Published: 2025-10-01 11:42 – Updated: 2026-05-11 19:19
VLAI
Title
remoteproc: imx_dsp_rproc: Add mutex protection for workqueue
Summary
In the Linux kernel, the following vulnerability has been resolved: remoteproc: imx_dsp_rproc: Add mutex protection for workqueue The workqueue may execute late even after remoteproc is stopped or stopping, some resources (rpmsg device and endpoint) have been released in rproc_stop_subdevices(), then rproc_vq_interrupt() accessing these resources will cause kennel dump. Call trace: virtqueue_add_split+0x1ac/0x560 virtqueue_add_inbuf+0x4c/0x60 rpmsg_recv_done+0x15c/0x294 vring_interrupt+0x6c/0xa4 rproc_vq_interrupt+0x30/0x50 imx_dsp_rproc_vq_work+0x24/0x40 [imx_dsp_rproc] process_one_work+0x1d0/0x354 worker_thread+0x13c/0x470 kthread+0x154/0x160 ret_from_fork+0x10/0x20 Add mutex protection in imx_dsp_rproc_vq_work(), if the state is not running, then just skip calling rproc_vq_interrupt(). Also the flush workqueue operation can't be added in rproc stop for the same reason. The call sequence is rproc_shutdown -> rproc_stop ->rproc_stop_subdevices ->rproc->ops->stop() ->imx_dsp_rproc_stop ->flush_work -> rproc_vq_interrupt The resource needed by rproc_vq_interrupt has been released in rproc_stop_subdevices, so flush_work is not safe to be called in imx_dsp_rproc_stop.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ec0e5549f3586d2cb99a05edd006d722ebad912c , < 4a3e1fa7a77838617bdbcd95127ce93a959fad44 (git)
Affected: ec0e5549f3586d2cb99a05edd006d722ebad912c , < b9693304b7133b81741add5bfb56f022596df012 (git)
Affected: ec0e5549f3586d2cb99a05edd006d722ebad912c , < 47e6ab07018edebf94ce873cf50a05ec76ff2dde (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.16
Unaffected: 0 , < 5.16 (semver)
Unaffected: 6.0.18 , ≤ 6.0.* (semver)
Unaffected: 6.1.4 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/remoteproc/imx_dsp_rproc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4a3e1fa7a77838617bdbcd95127ce93a959fad44",
              "status": "affected",
              "version": "ec0e5549f3586d2cb99a05edd006d722ebad912c",
              "versionType": "git"
            },
            {
              "lessThan": "b9693304b7133b81741add5bfb56f022596df012",
              "status": "affected",
              "version": "ec0e5549f3586d2cb99a05edd006d722ebad912c",
              "versionType": "git"
            },
            {
              "lessThan": "47e6ab07018edebf94ce873cf50a05ec76ff2dde",
              "status": "affected",
              "version": "ec0e5549f3586d2cb99a05edd006d722ebad912c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/remoteproc/imx_dsp_rproc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.18",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.4",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: imx_dsp_rproc: Add mutex protection for workqueue\n\nThe workqueue may execute late even after remoteproc is stopped or\nstopping, some resources (rpmsg device and endpoint) have been\nreleased in rproc_stop_subdevices(), then rproc_vq_interrupt()\naccessing these resources will cause kennel dump.\n\nCall trace:\n virtqueue_add_split+0x1ac/0x560\n virtqueue_add_inbuf+0x4c/0x60\n rpmsg_recv_done+0x15c/0x294\n vring_interrupt+0x6c/0xa4\n rproc_vq_interrupt+0x30/0x50\n imx_dsp_rproc_vq_work+0x24/0x40 [imx_dsp_rproc]\n process_one_work+0x1d0/0x354\n worker_thread+0x13c/0x470\n kthread+0x154/0x160\n ret_from_fork+0x10/0x20\n\nAdd mutex protection in imx_dsp_rproc_vq_work(), if the state is\nnot running, then just skip calling rproc_vq_interrupt().\n\nAlso the flush workqueue operation can\u0027t be added in rproc stop\nfor the same reason. The call sequence is\n\nrproc_shutdown\n-\u003e rproc_stop\n   -\u003erproc_stop_subdevices\n   -\u003erproc-\u003eops-\u003estop()\n     -\u003eimx_dsp_rproc_stop\n       -\u003eflush_work\n         -\u003e rproc_vq_interrupt\n\nThe resource needed by rproc_vq_interrupt has been released in\nrproc_stop_subdevices, so flush_work is not safe to be called in\nimx_dsp_rproc_stop."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:19:15.999Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4a3e1fa7a77838617bdbcd95127ce93a959fad44"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9693304b7133b81741add5bfb56f022596df012"
        },
        {
          "url": "https://git.kernel.org/stable/c/47e6ab07018edebf94ce873cf50a05ec76ff2dde"
        }
      ],
      "title": "remoteproc: imx_dsp_rproc: Add mutex protection for workqueue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50426",
    "datePublished": "2025-10-01T11:42:05.613Z",
    "dateReserved": "2025-09-17T14:53:07.004Z",
    "dateUpdated": "2026-05-11T19:19:15.999Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50426",
      "date": "2026-09-15",
      "epss": "0.00154",
      "percentile": "0.04846"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50426\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-01T12:15:34.120\",\"lastModified\":\"2026-06-17T05:23:31.883\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nremoteproc: imx_dsp_rproc: Add mutex protection for workqueue\\n\\nThe workqueue may execute late even after remoteproc is stopped or\\nstopping, some resources (rpmsg device and endpoint) have been\\nreleased in rproc_stop_subdevices(), then rproc_vq_interrupt()\\naccessing these resources will cause kennel dump.\\n\\nCall trace:\\n virtqueue_add_split+0x1ac/0x560\\n virtqueue_add_inbuf+0x4c/0x60\\n rpmsg_recv_done+0x15c/0x294\\n vring_interrupt+0x6c/0xa4\\n rproc_vq_interrupt+0x30/0x50\\n imx_dsp_rproc_vq_work+0x24/0x40 [imx_dsp_rproc]\\n process_one_work+0x1d0/0x354\\n worker_thread+0x13c/0x470\\n kthread+0x154/0x160\\n ret_from_fork+0x10/0x20\\n\\nAdd mutex protection in imx_dsp_rproc_vq_work(), if the state is\\nnot running, then just skip calling rproc_vq_interrupt().\\n\\nAlso the flush workqueue operation can\u0027t be added in rproc stop\\nfor the same reason. The call sequence is\\n\\nrproc_shutdown\\n-\u003e rproc_stop\\n   -\u003erproc_stop_subdevices\\n   -\u003erproc-\u003eops-\u003estop()\\n     -\u003eimx_dsp_rproc_stop\\n       -\u003eflush_work\\n         -\u003e rproc_vq_interrupt\\n\\nThe resource needed by rproc_vq_interrupt has been released in\\nrproc_stop_subdevices, so flush_work is not safe to be called in\\nimx_dsp_rproc_stop.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/remoteproc/imx_dsp_rproc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ec0e5549f3586d2cb99a05edd006d722ebad912c\",\"lessThan\":\"4a3e1fa7a77838617bdbcd95127ce93a959fad44\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ec0e5549f3586d2cb99a05edd006d722ebad912c\",\"lessThan\":\"b9693304b7133b81741add5bfb56f022596df012\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ec0e5549f3586d2cb99a05edd006d722ebad912c\",\"lessThan\":\"47e6ab07018edebf94ce873cf50a05ec76ff2dde\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/remoteproc/imx_dsp_rproc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0.18\",\"lessThanOrEqual\":\"6.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.4\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.0.18\",\"matchCriteriaId\":\"08D38C5F-9644-4549-BBA6-F0860F024D14\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1\",\"versionEndExcluding\":\"6.1.4\",\"matchCriteriaId\":\"BC4189D9-5478-4E88-A78D-9C1DE29B217C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/47e6ab07018edebf94ce873cf50a05ec76ff2dde\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4a3e1fa7a77838617bdbcd95127ce93a959fad44\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b9693304b7133b81741add5bfb56f022596df012\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-21T18:46:19+00:00",
      "cve": "CVE-2022-50426",
      "id": "CVE-2022-50426",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: remoteproc: imx_dsp_rproc: Add mutex protection for workqueue",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50426.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-31T01:23:47Z",
      "cve": "CVE-2022-50426",
      "id": "CVE-2022-50426",
      "initial_release_date": "2025-10-01T23:32:58Z",
      "product_status:known_not_affected": "523",
      "product_status:recommended": "29",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50426",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50426.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.