---
id: CVE-2022-50314
title: 'nbd: Fix hung when signal interrupts nbd_start_device_ioctl()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nbd: Fix hung when signal interrupts nbd_start_device_ioctl()

  syzbot reported hung task [1].  The following program is a simplified
  version of the reproducer:

  int mai…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 <
    3ba3846cb3e2fb3c6fbf79e998472821b298419e
  - >-
    Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 <
    c7b4641bd2395c2f3cd3b0a0cbf292ed9d489398
  - >-
    Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 <
    3575949513ea3b387b30dac1e69468a923c86caf
  - >-
    Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 <
    b2700f98b3f4dd19fb4315b70581e5caff89eb49
  - >-
    Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 <
    c0d73be0af8c1310713bc39a8d7a22e35084e14f
  - >-
    Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 <
    62006a72b05e0d38727eef5188700f2488be5e89
  - >-
    Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 <
    35fb7d4a53d9e36d1b91161ea9870d9c6d57dccf
  - >-
    Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 <
    1de7c3cf48fc41cd95adb12bd1ea9033a917798a
  - Linux 4.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:09:37.321884Z'
published: '2025-09-15'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:10:34.522Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-50314'
references:
  - url: 'https://git.kernel.org/stable/c/3ba3846cb3e2fb3c6fbf79e998472821b298419e'
  - url: 'https://git.kernel.org/stable/c/c7b4641bd2395c2f3cd3b0a0cbf292ed9d489398'
  - url: 'https://git.kernel.org/stable/c/3575949513ea3b387b30dac1e69468a923c86caf'
  - url: 'https://git.kernel.org/stable/c/b2700f98b3f4dd19fb4315b70581e5caff89eb49'
  - url: 'https://git.kernel.org/stable/c/c0d73be0af8c1310713bc39a8d7a22e35084e14f'
  - url: 'https://git.kernel.org/stable/c/62006a72b05e0d38727eef5188700f2488be5e89'
  - url: 'https://git.kernel.org/stable/c/35fb7d4a53d9e36d1b91161ea9870d9c6d57dccf'
  - url: 'https://git.kernel.org/stable/c/1de7c3cf48fc41cd95adb12bd1ea9033a917798a'
tags:
  - cve.org
epss: 0.0016
epssPercentile: 0.05161
ingestedAt: '2026-11-05T22:38:31.724Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nbd: Fix hung when signal interrupts nbd_start_device_ioctl()

syzbot reported hung task [1].  The following program is a simplified
version of the reproducer:

int main(void)
{
	int sv[2], fd;

	if (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) < 0)
		return 1;
	if ((fd = open("/dev/nbd0", 0)) < 0)
		return 1;
	if (ioctl(fd, NBD_SET_SIZE_BLOCKS, 0x81) < 0)
		return 1;
	if (ioctl(fd, NBD_SET_SOCK, sv[0]) < 0)
		return 1;
	if (ioctl(fd, NBD_DO_IT) < 0)
		return 1;
	return 0;
}

When signal interrupt nbd_start_device_ioctl() waiting the condition
atomic_read(&config->recv_threads) == 0, the task can hung because it
waits the completion of the inflight IOs.

This patch fixes the issue by clearing queue, not just shutdown, when
signal interrupt nbd_start_device_ioctl().

## Affected

- `Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 < 3ba3846cb3e2fb3c6fbf79e998472821b298419e`
- `Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 < c7b4641bd2395c2f3cd3b0a0cbf292ed9d489398`
- `Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 < 3575949513ea3b387b30dac1e69468a923c86caf`
- `Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 < b2700f98b3f4dd19fb4315b70581e5caff89eb49`
- `Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 < c0d73be0af8c1310713bc39a8d7a22e35084e14f`
- `Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 < 62006a72b05e0d38727eef5188700f2488be5e89`
- `Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 < 35fb7d4a53d9e36d1b91161ea9870d9c6d57dccf`
- `Linux >= 5ea8d10802ec4c153a6e21eebaf412e2abd29736 < 1de7c3cf48fc41cd95adb12bd1ea9033a917798a`
- `Linux 4.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.