CVE-2022-50008: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50008 is a Linux kernel vulnerability in the kprobes subsystem where __disable_kprobe() incorrectly calls disarm_kprobe() on an already-disarmed kprobe, triggering an infinite loop and system instability. The flaw is classified as CWE-835 (Loop with Unreachable Exit Condition). It affects multiple Linux kernel versions: 4.0–4.9.326, 4.10–4.14.291, 4.15–4.19.256, 4.20–5.4.211, 5.5–5.10.140, 5.11–5.15.64, 5.16–5.19.5, and release candidates 6.0-rc1 and 6.0-rc2. The CVE was published on June 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is an incorrect assumption in __disable_kprobe(): when kprobes_all_disarmed is set to false (by writing 1 to /sys/kernel/debug/kprobes/enabled), the function does not re-arm previously disabled kprobes, but subsequently attempts to call disarm_kprobe() on them anyway. This triggers WARN_ONCE() in __disarm_kprobe_ftrace() twice, and __unregister_kprobe_top() misses cleanup steps, leaving aggregated kprobes in the hash table. The resulting state can cause RCU (Read-Copy-Update) stalls and soft lockups, classified under CWE-835 (Infinite Loop). Exploitation requires local access with low privileges and is reproducible by toggling /sys/kernel/debug/kprobes/enabled while a BCC tracing tool (e.g., execsnoop) is running (Feedly, Kernel Patch).

Successful exploitation degrades system availability through RCU stalls, soft lockups, and potential system hangs or unresponsiveness. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue affecting the local system. Systems running tracing or observability tools (e.g., BCC/eBPF-based tools) on vulnerable kernel versions are at elevated risk of triggering this condition (Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating very low probability of exploitation in the near term. Exploitation requires local access with low privileges, limiting the attack surface (Feedly).

1. Gain local access: Obtain a low-privileged local account on a system running a vulnerable Linux kernel version (4.0–5.19.5 or 6.0-rc1/rc2).
2. Disable all kprobes globally: Write 0 to the kprobes control file: echo 0 > /sys/kernel/debug/kprobes/enabled. This sets kprobes_all_disarmed to true and disarms all active kprobes.
3. Attach a tracing tool: Start a BCC or kprobe-based tracing tool (e.g., /usr/share/bcc/tools/execsnoop &), which registers a kprobe. Because kprobes are globally disabled, the newly registered kprobe remains in the [DISABLED] state.
4. Re-enable kprobes globally: Write 1 to the control file: echo 1 > /sys/kernel/debug/kprobes/enabled. This sets kprobes_all_disarmed to false but does NOT re-arm the disabled kprobe.
5. Trigger the bug: Terminate the tracing tool (e.g., kill %1 or Ctrl+C). The kernel's __disable_kprobe() calls disarm_kprobe() on the already-disarmed kprobe, firing WARN_ONCE() twice, leaving the aggregated kprobe in the hash table, and potentially causing RCU stalls or soft lockups (Feedly).

• Logs: Kernel warning messages in dmesg or /var/log/kern.log containing WARN_ONCE from __disarm_kprobe_ftrace() or related kprobes functions.
• Logs: RCU stall warnings or soft lockup messages in kernel logs (e.g., INFO: rcu_sched detected stalls, BUG: soft lockup).
• File System: Repeated or unusual writes to /sys/kernel/debug/kprobes/enabled visible in audit logs.
• Process: Unexpected termination or hang of BCC/eBPF-based tracing tools (e.g., execsnoop, opensnoop) coinciding with kernel warnings.
• Logs: Entries in /sys/kernel/debug/kprobes/list showing kprobes stuck in [DISABLED] state after global re-enable (Feedly).

Patches are available for all affected kernel stable branches: update to 4.9.327+, 4.14.292+, 4.19.257+, 5.4.212+, 5.10.141+, 5.15.65+, or 5.19.6+ as appropriate for your deployment. SUSE has issued vendor-specific kernel security advisories (SUSE-2025-02264-1, SUSE-2025-02537-1) incorporating these fixes (SUSE Advisory). As a short-term workaround on unpatched systems, avoid toggling /sys/kernel/debug/kprobes/enabled while kprobe-based tracing tools are active, and minimize use of BCC/eBPF tracing tools on vulnerable kernels (Feedly).

SUSE issued multiple kernel security advisories addressing CVE-2022-50008 alongside other kernel vulnerabilities (SUSE-2025-02264-1 and SUSE-2025-02537-1), indicating active vendor patching activity (SUSE Advisory, SUSE Advisory 2). No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability.