---
id: CVE-2022-50756
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nvme-pci: fix mempool alloc size

  Convert the max size to bytes to match the units of the divisor that
  calculates the worst-case number of PRP entries.

  The result is u…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nvme-pci: fix mempool alloc size

  Convert the max size to bytes to match the units of the divisor that
  calculates the worst-case number of PRP entries.

  The result is u…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 943e942e6266f22babee5efeb00f8f672fbff5bd <
    dfb6d54893d544151e7f480bc44cfe7823f5ad23
  - >-
    Linux >= 943e942e6266f22babee5efeb00f8f672fbff5bd <
    9141144b37f30e3e7fa024bcfa0a13011e546ba9
  - >-
    Linux >= 943e942e6266f22babee5efeb00f8f672fbff5bd <
    e1777b4286e526c58b4ee699344b0ad85aaf83a0
  - >-
    Linux >= 943e942e6266f22babee5efeb00f8f672fbff5bd <
    b1814724e0d7162bdf4799f2d565381bc2251c63
  - >-
    Linux >= 943e942e6266f22babee5efeb00f8f672fbff5bd <
    c89a529e823d51dd23c7ec0c047c7a454a428541
  - Linux 4.18
published: '2025-12-24'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:17:33.853'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-50756'
references:
  - url: 'https://git.kernel.org/stable/c/9141144b37f30e3e7fa024bcfa0a13011e546ba9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b1814724e0d7162bdf4799f2d565381bc2251c63'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c89a529e823d51dd23c7ec0c047c7a454a428541'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dfb6d54893d544151e7f480bc44cfe7823f5ad23'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e1777b4286e526c58b4ee699344b0ad85aaf83a0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00201
epssPercentile: 0.0992
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:32:29.362408Z'
ingestedAt: '2026-10-15T22:48:25.382Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nvme-pci: fix mempool alloc size

Convert the max size to bytes to match the units of the divisor that
calculates the worst-case number of PRP entries.

The result is used to determine how many PRP Lists are required. The
code was previously rounding this to 1 list, but we can require 2 in the
worst case. In that scenario, the driver would corrupt memory beyond the
size provided by the mempool.

While unlikely to occur (you'd need a 4MB in exactly 127 phys segments
on a queue that doesn't support SGLs), this memory corruption has been
observed by kfence.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.