DRBD Vulnerability in Linux Kernel by Linux Foundation

CVE-2022-50506

What is CVE-2022-50506?

A vulnerability in the DRBD implementation of the Linux kernel allows for a null pointer dereference when attempting to allocate a 'bio' structure without a valid backing device. This arises during the processing of diskless DRBD devices, which leads to potential stability issues. A recent commit inadvertently adjusted the order of operations related to device checks, resulting in this flaw. Optimizing the allocation process ensures that the system only creates necessary structures when a valid disk is present, mitigating the risk of encountering null pointer dereferences.

References