CVE-2022-50059: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50059 is a denial-of-service vulnerability in the Linux kernel's Ceph file system subsystem, caused by a failure to release the snap_rwsem (snapshot read-write semaphore) in all code paths within the handle_cap_grant function during an IMPORT operation. This semaphore leak can result in a system deadlock. The vulnerability affects Linux kernel versions 5.8.x before 5.10.138, 5.11.x before 5.15.63, and 5.16.x before 5.19.4. It was published on June 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as improper resource release (CWE-667: Improper Locking). When handle_cap_grant is invoked for a Ceph capability IMPORT operation, the function acquires snap_rwsem but fails to release it in all return paths, leaving the semaphore held. This is a local vulnerability requiring low privileges and no user interaction; an attacker with local access to a system using the Ceph file system can trigger the affected code path to cause the semaphore to remain locked, eventually leading to a deadlock. Patches are available in the upstream Linux kernel stable tree (Kernel Patches, Feedly).

Successful exploitation results in a system deadlock, causing a denial of service where the affected system may become unresponsive and require a forced restart. There is no impact on confidentiality or integrity — the vulnerability is limited to availability (CVSS availability impact: High). Systems running Ceph-backed workloads (e.g., storage clusters or cloud infrastructure nodes) are at elevated risk of service disruption (Feedly).

Patches have been released for the affected Linux kernel stable branches: upgrade to kernel version 5.10.138 or later (for 5.8.x–5.10.x), 5.15.63 or later (for 5.11.x–5.15.x), or 5.19.4 or later (for 5.16.x–5.19.x). The fixes are available in the upstream kernel stable tree (Kernel Patches). SUSE has also issued updated kernel packages addressing this CVE (Linux Security SUSE). For systems that cannot be immediately patched, restricting local user access and monitoring system responsiveness are recommended interim measures (Feedly).

SUSE has issued multiple kernel security advisories addressing CVE-2022-50059 as part of broader Linux kernel update packages (Linux Security SUSE, Linux Security SUSE 2). No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability.