CVE-2022-50211: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50211 is an out-of-bounds read vulnerability in the Linux kernel's MD-RAID10 subsystem, specifically in the raid10_remove_disk function. The flaw causes a KASAN (Kernel Address SANitizer) slab-out-of-bounds warning when a disk removal operation is triggered with an invalid number value during RAID10 reshape operations. Affected kernel versions span multiple stable branches: before 4.9.326, 4.10–4.14.291, 4.15–4.19.256, 4.20–5.4.211, 5.5–5.10.137, 5.11–5.15.61, 5.16–5.18.18, and 5.19–5.19.2. It was publicly disclosed on June 18, 2025, and carries a CVSS v3.1 base score of 7.1 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an out-of-bounds read (CWE-125) in the raid10_remove_disk function within the Linux kernel's raid10 module. When the remove_and_add_spares routine calls raid10_remove_disk, the number parameter is not validated against the bounds of the allocated configuration structure before being used as an array index, resulting in a read 0 bytes past the end of a 256-byte kmalloc-256 slab object. The vulnerability is triggered locally during RAID10 disk removal operations — for example, when running LVM reshape tests (lvconvert-raid-reshape.sh) — and requires low-privilege local access to a system with an active RAID10 array. The fix adds a bounds check on the number value before the array dereference (Red Hat Bugzilla, kernel.org patches).

Successful exploitation can result in high confidentiality impact (reading out-of-bounds kernel memory), high availability impact (potential kernel panic or system instability), and no direct integrity impact, consistent with the CVSS score. An attacker with low-privilege local access could trigger the out-of-bounds read to potentially leak sensitive kernel memory contents or destabilize RAID10 array operations, leading to data unavailability. The vulnerability is confined to systems running the affected kernel versions with RAID10 configurations active (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.033% (0.000330), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges and a system actively using RAID10 arrays (Red Hat Bugzilla, Feedly).

Apply the upstream kernel patches available across multiple stable branches via kernel.org. Red Hat has issued several errata addressing this vulnerability across affected RHEL versions: RHSA-2025:15656 (RHEL 8.2 AUS), RHSA-2025:17109 and RHSA-2025:17161 (RHEL 7 ELS), RHSA-2025:17124 (RHEL 8.6 AUS/E4S/TUS), RHSA-2025:17159 and RHSA-2025:17192 (RHEL 9.0 E4S), and RHSA-2025:22752 (RHEL 8.4 AUS/EUS). SUSE has also released updates (SUSE-SU-2025:02308-1, SUSE-SU-2025:02848-1). As a workaround where patching is not immediately possible, restrict local user access to systems running RAID10 configurations and monitor for unexpected KASAN kernel messages (Red Hat Bugzilla, Red Hat Advisory).