CVE-2022-50889: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50889 is a Use-After-Free (UAF) vulnerability in the Linux kernel's dm integrity subsystem, specifically within the dm_integrity_dtr() function. The flaw arises when dm_resume() and dm_destroy() are executed concurrently, leading to a race condition that results in a UAF memory access. It affects Linux kernel versions from 4.12 (when dm-integrity was introduced) up to the patched releases. The vulnerability was published on December 30, 2025, and carries an estimated CVSS severity of Medium (Feedly, CIRCL).

The root cause is a Use-After-Free condition (CWE-416) in the dm_integrity_dtr() destructor function of the Linux kernel's device-mapper integrity target. When dm_resume() and dm_destroy() are called concurrently, a kernel timer may fire after the associated memory has been freed, resulting in a UAF access. The fix involves cancelling the timer again within dm_integrity_dtr() to ensure the timer cannot fire after the associated data structures are released — mirroring a similar fix applied elsewhere in the dm subsystem. Patches were backported to multiple stable kernel branches (Feedly, kernel.org patch 1, kernel.org patch 2).

Exploitation of this UAF vulnerability could allow a local attacker with sufficient privileges to trigger kernel memory corruption, potentially leading to a kernel panic (denial of service) or, in more severe scenarios, privilege escalation or arbitrary code execution in kernel context. The vulnerability is confined to systems using the dm-integrity device-mapper target, limiting the affected asset scope to Linux systems with this feature enabled. Data integrity and system availability are the primary concerns (Feedly, CIRCL).

The vulnerability has been fixed in multiple stable Linux kernel branches. Patched versions include: 5.4.229, 5.10.163, 5.15.87, 6.0.18, 6.1.4, and 6.2 (mainline). System administrators should update to one of these patched kernel versions as soon as possible. As a temporary workaround, disabling the dm-integrity target on affected systems can reduce exposure, though this may impact storage integrity verification functionality (Feedly, kernel.org patch 1, SUSE Advisory).