CVE-2022-50583: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50583 is a bug in the Linux kernel's md/raid0 and raid10 subsystems where max_discard_sectors is incorrectly set for request queues on rotational (non-SSD/NVMe) member disks. Instead of using disk_stack_limits to derive a proper value, the drivers set the value directly, causing incorrect discard sector reporting. This results in kernel warning messages (WARN_ON) triggered in __blkdev_issue_discard during operations such as mkfs.xfs. The vulnerability was published on December 8, 2025, and is estimated as Medium severity with an EPSS score of 0.000170 (Feedly, CIRCL).

The root cause is improper handling of discard sector limits in the Linux kernel's RAID stack drivers (md/raid0 and raid10), classified under incorrect calculation or use of block device limits (related to CWE-682: Incorrect Calculation). When all member disks are rotational devices, the RAID layer incorrectly exports a non-zero max_discard_sectors value to the request queue, which should only be set for devices that support discard (e.g., SSDs/NVMe). The fix requires using disk_stack_limits to properly inherit and propagate discard capabilities from member devices rather than setting the value directly. The bug manifests as a kernel WARNING in block/blk-lib.c:50 (__blkdev_issue_discard) when user-space tools like mkfs.xfs attempt discard operations (Feedly).

The primary impact is a kernel warning (WARN_ON) that can be triggered during filesystem creation or discard operations on RAID0/RAID10 arrays composed of rotational disks. This does not result in arbitrary code execution or privilege escalation, but can cause unexpected kernel log noise, potential system instability, or incorrect block device behavior when discard operations are issued to non-supporting hardware. In production environments, this could lead to degraded reliability or unexpected I/O errors during storage provisioning (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50583. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is very low at 0.000170, indicating a minimal probability of exploitation in the near term. The issue is a logic/correctness bug rather than a security vulnerability in the traditional sense, and exploitation would require local access to trigger discard operations on an affected RAID array (Feedly, Tenable).

Apply the upstream Linux kernel patches that correct the discard sector limit handling in md/raid0 and raid10 by using disk_stack_limits instead of directly setting max_discard_sectors. The relevant fixes are available in the Linux stable kernel tree (commits 8e1a2279ca2b, 27e5d61a8e69, and e80bef070699). Users should update to a patched kernel version provided by their Linux distribution. As a workaround, disabling discard/TRIM operations on RAID0/RAID10 arrays composed of rotational disks can prevent the warning from being triggered (Feedly, Tenable).