CVE-2022-50174: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50174 affects the Linux kernel's hinic network device driver. The vulnerability was discovered and disclosed on June 18, 2025. The issue occurs when using hinic device as a bond slave device and reading device stats of the master bond device, which can cause the kernel to hang (NVD).

The vulnerability manifests in the hinicgetstats64() function when the device is used as a bond slave. When getting device stats from bond, the kernel calls bondgetstats() which holds the spinlock bond->statslock and then calls hinicgetstats64(). The function hinicgetstats64() calls down(&nicdev->mgmt_lock) to protect its critical section, which may schedule the current task out. Under high system pressure, the task cannot be woken up immediately, triggering a kernel hung panic (NVD, Wiz).

When exploited, this vulnerability can cause a kernel hang (soft lockup), leading to system unresponsiveness. This primarily affects systems using the hinic network device driver in a bonding configuration (Wiz).

The fix involves removing the down()/up() calls in hinicgetstats64() since a previous patch has replaced hinicdev.txstats/rx_stats with local variables, eliminating the need for lock protection (NVD, Wiz).