CVE-2022-50889

A use-after-free vulnerability was found in the Linux kernel's device mapper integrity subsystem. When dm_resume() and dm_destroy() execute concurrently, a timer may fire and access freed memory because dm_integrity_dtr() did not properly cancel the timer before freeing resources. The fix adds an additional timer cancellation in the destructor path.

This flaw requires a race condition between dm_resume() and dm_destroy() operations on a dm-integrity device. While use-after-free bugs can have serious consequences, the narrow timing window and requirement for privileged device-mapper operations significantly limit exploitability in practice.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.