{"id":"CVE-2022-50314","title":"nbd: Fix hung when signal interrupts nbd_start_device_ioctl()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: Fix hung when signal interrupts nbd_start_device_ioctl()\n\nsyzbot reported hung task [1].  The following program is a simplified\nversion of the reproducer:\n\nint mai…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 < 3ba3846cb3e2fb3c6fbf79e998472821b298419e","Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 < c7b4641bd2395c2f3cd3b0a0cbf292ed9d489398","Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 < 3575949513ea3b387b30dac1e69468a923c86caf","Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 < b2700f98b3f4dd19fb4315b70581e5caff89eb49","Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 < c0d73be0af8c1310713bc39a8d7a22e35084e14f","Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 < 62006a72b05e0d38727eef5188700f2488be5e89","Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 < 35fb7d4a53d9e36d1b91161ea9870d9c6d57dccf","Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 < 1de7c3cf48fc41cd95adb12bd1ea9033a917798a","Linux 4.12"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:09:37.321884Z"},"published":"2025-09-15","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:10:34.522Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2022-50314","references":[{"url":"https://git.kernel.org/stable/c/3ba3846cb3e2fb3c6fbf79e998472821b298419e"},{"url":"https://git.kernel.org/stable/c/c7b4641bd2395c2f3cd3b0a0cbf292ed9d489398"},{"url":"https://git.kernel.org/stable/c/3575949513ea3b387b30dac1e69468a923c86caf"},{"url":"https://git.kernel.org/stable/c/b2700f98b3f4dd19fb4315b70581e5caff89eb49"},{"url":"https://git.kernel.org/stable/c/c0d73be0af8c1310713bc39a8d7a22e35084e14f"},{"url":"https://git.kernel.org/stable/c/62006a72b05e0d38727eef5188700f2488be5e89"},{"url":"https://git.kernel.org/stable/c/35fb7d4a53d9e36d1b91161ea9870d9c6d57dccf"},{"url":"https://git.kernel.org/stable/c/1de7c3cf48fc41cd95adb12bd1ea9033a917798a"}],"tags":["cve.org"],"epss":0.0016,"epssPercentile":0.05161,"ingestedAt":"2026-11-05T22:38:31.724Z","slug":"CVE-2022-50314","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnbd: Fix hung when signal interrupts nbd_start_device_ioctl()\n\nsyzbot reported hung task [1].  The following program is a simplified\nversion of the reproducer:\n\nint main(void)\n{\n\tint sv[2], fd;\n\n\tif (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) < 0)\n\t\treturn 1;\n\tif ((fd = open(\"/dev/nbd0\", 0)) < 0)\n\t\treturn 1;\n\tif (ioctl(fd, NBD_SET_SIZE_BLOCKS, 0x81) < 0)\n\t\treturn 1;\n\tif (ioctl(fd, NBD_SET_SOCK, sv[0]) < 0)\n\t\treturn 1;\n\tif (ioctl(fd, NBD_DO_IT) < 0)\n\t\treturn 1;\n\treturn 0;\n}\n\nWhen signal interrupt nbd_start_device_ioctl() waiting the condition\natomic_read(&config->recv_threads) == 0, the task can hung because it\nwaits the completion of the inflight IOs.\n\nThis patch fixes the issue by clearing queue, not just shutdown, when\nsignal interrupt nbd_start_device_ioctl().\n\n## Affected\n\n- `Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 < 3ba3846cb3e2fb3c6fbf79e998472821b298419e`\n- `Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 < c7b4641bd2395c2f3cd3b0a0cbf292ed9d489398`\n- `Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 < 3575949513ea3b387b30dac1e69468a923c86caf`\n- `Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 < b2700f98b3f4dd19fb4315b70581e5caff89eb49`\n- `Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 < c0d73be0af8c1310713bc39a8d7a22e35084e14f`\n- `Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 < 62006a72b05e0d38727eef5188700f2488be5e89`\n- `Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 < 35fb7d4a53d9e36d1b91161ea9870d9c6d57dccf`\n- `Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 < 1de7c3cf48fc41cd95adb12bd1ea9033a917798a`\n- `Linux 4.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}