CVE-2022-50350
A race condition in the Linux kernel’s iSCSI target module can cause a kernel crash when a malicious initiator sends data immediately after a login. The bug allows the kernel to dereference a freed socket structure, leading to a crash. The issue has been fixed in newer kernel releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel systems that expose iSCSI targets, such as servers running the iscsi_target module.
Real-world impact
An attacker could crash the kernel, causing a denial of service on the affected system.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network, requires no user interaction, and can lead to complete compromise of confidentiality, integrity, and availability. The high impact and ease of exploitation result in a critical rating.
What to do about it
- 01Update the Linux kernel to a version that includes the fix for CVE-2022-50350.
NVD description
Timeline
- Sep 16, 2025 · Sep 16, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 1d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.