pnode: terminate at peers of source

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2022-50280
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2025-09-15 15:15:39 UTC
Updated2026-11-05 20:17:32 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: pnode: terminate at peers of source The propagate_mnt() function handles mount propagation when creating mounts and propagates the source mount tree @source_mnt to all applicable nodes of the destination propagation mount tree headed by @dest_mnt. Unfortunately it contains a bug where it fails to terminate at peers of @source_mnt when looking up copies of the source mount that become masters for copies of the source mount tree mounted on top of slaves in the destination propagation tree causing a NULL dereference. Once the mechanics of the bug are understood it's easy to trigger. Because of unprivileged user namespaces it is available to unprivileged users. While fixing this bug we've gotten confused multiple times due to unclear terminology or missing concepts. So let's start this with some clarifications: * The terms "master" or "peer" denote a shared mount. A shared mount belongs to a peer group. * A peer group is a set of shared mounts that propagate to each other. They are identified by a peer group id. The peer group id is available in @shared_mnt->mnt_group_id. Shared mounts within the same peer group have the same peer group id. The peers in a peer group can be reached via @shared_mnt->mnt_share. * The terms "slave mount" or "dependent mount" denote a mount that receives propagation from a peer in a peer group. IOW, shared mounts may have slave mounts and slave mounts have shared mounts as their master. Slave mounts of a given peer in a peer group are listed on that peers slave list available at @shared_mnt->mnt_slave_list. * The term "master mount" denotes a mount in a peer group. IOW, it denotes a shared mount or a peer mount in a peer group. The term "master mount" - or "master" for short - is mostly used when talking in the context of slave mounts that receive propagation from a master mount. A master mount of a slave identifies the closest peer group a slave mount receives propagation from. The master mount of a slave can be identified via @slave_mount->mnt_master. Different slaves may point to different masters in the same peer group. * Multiple peers in a peer group can have non-empty ->mnt_slave_lists. Non-empty ->mnt_slave_lists of peers don't intersect. Consequently, to ensure all slave mounts of a peer group are visited the ->mnt_slave_lists of all peers in a peer group have to be walked. * Slave mounts point to a peer in the closest peer group they receive propagation from via @slave_mnt->mnt_master (see above). Together with these peers they form a propagation group (see below). The closest peer group can thus be identified through the peer group id @slave_mnt->mnt_master->mnt_group_id of the peer/master that a slave mount receives propagation from. * A shared-slave mount is a slave mount to a peer group pg1 while also a peer in another peer group pg2. IOW, a peer group may receive propagation from another peer group. If a peer group pg1 is a slave to another peer group pg2 then all peers in peer group pg1 point to the same peer in peer group pg2 via ->mnt_master. IOW, all peers in peer group pg1 appear on the same ->mnt_slave_list. IOW, they cannot be slaves to different peer groups. * A pure slave mount is a slave mount that is a slave to a peer group but is not a peer in another peer group. * A propagation group denotes the set of mounts consisting of a single peer group pg1 and all slave mounts and shared-slave mounts that point to a peer in that peer group via ->mnt_master. IOW, all slave mounts such that @slave_mnt->mnt_master->mnt_group_id is equal to @shared_mnt->mnt_group_id. The concept of a propagation group makes it easier to talk about a single propagation level in a propagation tree. For example, in propagate_mnt() the immediate peers of @dest_mnt and all slaves of @dest_mnt's peer group form a propagation group pr ---truncated---

Risk And Classification

Primary CVSS: v3.1 5.5 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Problem Types: CWE-476

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected f2ebb3a921c1ca1e2ddd9242e95a1989a50c4c68 cad0d17fb2b0540180ab59e2cd48ad348cc1ee4c git Not specified
CNA Linux Linux affected f2ebb3a921c1ca1e2ddd9242e95a1989a50c4c68 cc997490be65da0af8c75a6244fc80bb66c53ce0 git Not specified
CNA Linux Linux affected f2ebb3a921c1ca1e2ddd9242e95a1989a50c4c68 7f57df69de7f05302fad584eb8e3f34de39e0311 git Not specified
CNA Linux Linux affected f2ebb3a921c1ca1e2ddd9242e95a1989a50c4c68 2dae4211b579ce98985876a73a78466e285238ff git Not specified
CNA Linux Linux affected f2ebb3a921c1ca1e2ddd9242e95a1989a50c4c68 b591b2919d018ef91b4a9571edca94105bcad3df git Not specified
CNA Linux Linux affected f2ebb3a921c1ca1e2ddd9242e95a1989a50c4c68 c24cc476acd8bccb5af54849aac5e779d8223bf5 git Not specified
CNA Linux Linux affected f2ebb3a921c1ca1e2ddd9242e95a1989a50c4c68 e7c9f10c44a8919cd8bbd51b228c84d0caf7d518 git Not specified
CNA Linux Linux affected f2ebb3a921c1ca1e2ddd9242e95a1989a50c4c68 784a4f995ee24460aa72e00b085612fad57ebce5 git Not specified
CNA Linux Linux affected f2ebb3a921c1ca1e2ddd9242e95a1989a50c4c68 11933cf1d91d57da9e5c53822a540bbdc2656c16 git Not specified
CNA Linux Linux affected fc7b1646bf29f722277bdd19551e01420ce9da8f git Not specified
CNA Linux Linux affected 3.14.3 3.15 semver Not specified
CNA Linux Linux affected 3.15 Not specified
CNA Linux Linux unaffected 3.15 semver Not specified
CNA Linux Linux unaffected 4.9.337 4.9.* semver Not specified
CNA Linux Linux unaffected 4.14.303 4.14.* semver Not specified
CNA Linux Linux unaffected 4.19.270 4.19.* semver Not specified
CNA Linux Linux unaffected 5.4.229 5.4.* semver Not specified
CNA Linux Linux unaffected 5.10.163 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.87 5.15.* semver Not specified
CNA Linux Linux unaffected 6.0.17 6.0.* semver Not specified
CNA Linux Linux unaffected 6.1.3 6.1.* semver Not specified
CNA Linux Linux unaffected 6.2 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/11933cf1d91d57da9e5c53822a540bbdc2656c16 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/cad0d17fb2b0540180ab59e2cd48ad348cc1ee4c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/cc997490be65da0af8c75a6244fc80bb66c53ce0 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/c24cc476acd8bccb5af54849aac5e779d8223bf5 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/b591b2919d018ef91b4a9571edca94105bcad3df 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/e7c9f10c44a8919cd8bbd51b228c84d0caf7d518 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/7f57df69de7f05302fad584eb8e3f34de39e0311 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/784a4f995ee24460aa72e00b085612fad57ebce5 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/2dae4211b579ce98985876a73a78466e285238ff 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report