In the Linux kernel, the following vulnerability has been resolved: net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks() syzbot is reporting lockdep warning at rds_tcp_reset_callbacks() [1], for commit ac3615e7f3cffe2a ("RDS: TCP: Reduce code duplication in rds_tcp_reset_callbacks()") added cancel_delayed_work_sync() into a section protected by lock_sock() without realizing that rds_send_xmit() might call lock_sock(). We don't need to protect cancel_delayed_work_sync() using lock_sock(), for even if rds_{send,recv}_worker() re-queued this work while __flush_work() from cancel_delayed_work_sync() was waiting for this work to complete, retried rds_{send,recv}_worker() is no-op due to the absence of RDS_CONN_UP bit.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/2425007c0967a7c04b0dee7cce05ecf0ca869ad1 cve-icon cve-icon
https://git.kernel.org/stable/c/30bfa5aa7228eb1e67663d67e553627e572cc717 cve-icon cve-icon
https://git.kernel.org/stable/c/360aa7219285fac63dab99706a16f2daf3222abe cve-icon cve-icon
https://git.kernel.org/stable/c/5d2ba255e93211e541373469dffbda7c99dfa0e5 cve-icon cve-icon
https://git.kernel.org/stable/c/a91b750fd6629354460282bbf5146c01b05c4859 cve-icon cve-icon
https://git.kernel.org/stable/c/afe7053c390fe8ff27d0c2ceaece5625283044ba cve-icon cve-icon
https://git.kernel.org/stable/c/c380c28ab9b15fc53565909c814f6dd3e7f77c4b cve-icon cve-icon
https://git.kernel.org/stable/c/da349221c4d2d4ac5f606c1c3b36d4ef0b3e6a0c cve-icon cve-icon
https://git.kernel.org/stable/c/e3cb25d3ad08f5dbd53ce2b31720cad529944322 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025120948-CVE-2022-50676-1387@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-50676 cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-50676 cve-icon
History

Wed, 10 Dec 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Tue, 09 Dec 2025 02:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks() syzbot is reporting lockdep warning at rds_tcp_reset_callbacks() [1], for commit ac3615e7f3cffe2a ("RDS: TCP: Reduce code duplication in rds_tcp_reset_callbacks()") added cancel_delayed_work_sync() into a section protected by lock_sock() without realizing that rds_send_xmit() might call lock_sock(). We don't need to protect cancel_delayed_work_sync() using lock_sock(), for even if rds_{send,recv}_worker() re-queued this work while __flush_work() from cancel_delayed_work_sync() was waiting for this work to complete, retried rds_{send,recv}_worker() is no-op due to the absence of RDS_CONN_UP bit.
Title net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-12-09T01:29:29.166Z

Updated: 2025-12-09T01:29:29.166Z

Reserved: 2025-12-09T01:26:45.991Z

Link: CVE-2022-50676

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-12-09T16:17:19.843

Modified: 2025-12-09T18:37:13.640

Link: CVE-2022-50676

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-12-09T00:00:00Z

Links: CVE-2022-50676 - Bugzilla