{"id":"CVE-2022-50756","revision":"f1ca431e4c8448d0bda8fb0a7f67eb4e","records":[{"revision":"f1ca431e4c8448d0bda8fb0a7f67eb4e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2022-50756","aliases":[],"title":"nvme-pci: fix mempool alloc size","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: fix mempool alloc size\n\nConvert the max size to bytes to match the units of the divisor that\ncalculates the worst-case number of PRP entries.\n\nThe result is used to determine how many PRP Lists are required. The\ncode was previously rounding this to 1 list, but we can require 2 in the\nworst case. In that scenario, the driver would corrupt memory beyond the\nsize provided by the mempool.\n\nWhile unlikely to occur (you'd need a 4MB in exactly 127 phys segments\non a queue that doesn't support SGLs), this memory corruption has been\nobserved by kfence.","state":0,"publishedAt":"2025-12-24T13:05:49.635+00:00","modifiedAt":"2026-10-15T21:41:23.908+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/nvme/host/pci.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"943e942e6266f22babee5efeb00f8f672fbff5bd\",\n                            \"lessThan\": \"dfb6d54893d544151e7f480bc44cfe7823f5ad23\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"943e942e6266f22babee5efeb00f8f672fbff5bd\",\n                            \"lessThan\": \"9141144b37f30e3e7fa024bcfa0a13011e546ba9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"943e942e6266f22babee5efeb00f8f672fbff5bd\",\n                            \"lessThan\": \"e1777b4286e526c58b4ee699344b0ad85aaf83a0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"943e942e6266f22babee5efeb00f8f672fbff5bd\",\n                            \"lessThan\": \"b1814724e0d7162bdf4799f2d565381bc2251c63\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"943e942e6266f22babee5efeb00f8f672fbff5bd\",\n                            \"lessThan\": \"c89a529e823d51dd23c7ec0c047c7a454a428541\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/nvme/host/pci.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.18\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.18\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.163\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.87\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.0.17\",\n                            \"lessThanOrEqual\": \"6.0.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.3\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/dfb6d54893d544151e7f480bc44cfe7823f5ad23","https://git.kernel.org/stable/c/9141144b37f30e3e7fa024bcfa0a13011e546ba9","https://git.kernel.org/stable/c/e1777b4286e526c58b4ee699344b0ad85aaf83a0","https://git.kernel.org/stable/c/b1814724e0d7162bdf4799f2d565381bc2251c63","https://git.kernel.org/stable/c/c89a529e823d51dd23c7ec0c047c7a454a428541"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2022-50756","license":"CVE Program Terms of Use","key":"cve-program:CVE-2022-50756","identifiers":["CVE-2022-50756"]},"retained":false,"historicalAffected":[]}],"coverage":[]}