CVE-2022-50752: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50752 is a denial-of-service vulnerability in the Linux kernel's md/raid5 subsystem, specifically in the raid5_read_one_chunk() function. The flaw involves an unnecessary bio_put() call in the bad-block error path that results in a double-free of a bio object when chunk-sized reads encounter disks with bad blocks. It affects the Linux kernel and was publicly disclosed on December 24, 2025, via the upstream CVE announcement mailing list. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium), with a local attack vector requiring low privileges (Red Hat CVE, Red Hat Bugzilla).

The root cause is a double-free bug (CWE-415) introduced after a code refactoring commit (c82aa1b76787c, "md/raid5: move checking badblock before clone bio in raid5_read_one_chunk"). That commit moved the bad-block check ahead of bio_alloc_clone(), but left behind a bio_put() call that was only valid in the prior code structure where align_bio had already been allocated. After the move, raid_bio is returned to the common I/O path which performs its own endio and bio_put(), resulting in a duplicate free when a bad block is encountered. Exploitation requires local access with low privileges and the ability to trigger chunk-sized reads on a RAID5 array that has disks with bad blocks (Red Hat Bugzilla).

Successful exploitation causes a kernel slab allocator corruption (BUG bio-200: Object already free), which crashes or destabilizes the affected system, resulting in a denial of service with high availability impact. There is no confidentiality or integrity impact. The vulnerability is limited in scope to the local system running a RAID5 array with bad-block-affected disks, and there is no known potential for lateral movement or data exfiltration (Red Hat CVE, Red Hat Bugzilla).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing BUG bio-<N> (Not tainted): Object already free slab corruption messages related to bio_put() in the raid5_make_request or handle_failed_stripe call stack.
• Process: Kernel worker threads such as kworker/u*:* (specifically raid5wq/raid5_do_work) appearing in crash stack traces at the time of the kernel BUG.
• System: Unexpected system panics or kernel oops events on hosts running RAID5 arrays with disks reporting bad blocks during readahead or chunk-sized read operations.

The fix removes the unnecessary bio_put() call from the bad-block error path in raid5_read_one_chunk(). Upstream kernel patches have been committed to stable kernel trees (referenced via git.kernel.org stable commits). Downstream distributions including Amazon Linux 2 (ALAS2KERNEL-5.15-2025-090) and SUSE have issued advisories incorporating the fix. Users should update to a patched kernel version provided by their Linux distribution as soon as possible (Red Hat Bugzilla, Amazon Linux Advisory).