{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.2-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.2-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.2-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  net: hinic: avoid kernel hung in hinic_get_stats64()  When using hinic device as a bond slave device, and reading device stats of master bond device, the kernel may hung.  The kernel panic calltrace as follows: Kernel panic - not syncing: softlockup: hung tasks Call trace:   native_queued_spin_lock_slowpath+0x1ec/0x31c   dev_get_stats+0x60/0xcc   dev_seq_printf_stats+0x40/0x120   dev_seq_show+0x1c/0x40   seq_read_iter+0x3c8/0x4dc   seq_read+0xe0/0x130   proc_reg_read+0xa8/0xe0   vfs_read+0xb0/0x1d4   ksys_read+0x70/0xfc   __arm64_sys_read+0x20/0x30   el0_svc_common+0x88/0x234   do_el0_svc+0x2c/0x90   el0_svc+0x1c/0x30   el0_sync_handler+0xa8/0xb0   el0_sync+0x148/0x180  And the calltrace of task that actually caused kernel hungs as follows:   __switch_to+124   __schedule+548   schedule+72   schedule_timeout+348   __down_common+188   __down+24   down+104   hinic_get_stats64+44 [hinic]   dev_get_stats+92   bond_get_stats+172 [bonding]   dev_get_stats+92   dev_seq_printf_stats+60   dev_seq_show+24   seq_read_iter+964   seq_read+220   proc_reg_read+164   vfs_read+172   ksys_read+108   __arm64_sys_read+28   el0_svc_common+132   do_el0_svc+40   el0_svc+24   el0_sync_handler+164   el0_sync+324  When getting device stats from bond, kernel will call bond_get_stats(). It first holds the spinlock bond-\u003estats_lock, and then call hinic_get_stats64() to collect hinic device's stats. However, hinic_get_stats64() calls `down(\u0026nic_dev-\u003emgmt_lock)` to protect its critical section, which may schedule current task out. And if system is under high pressure, the task cannot be woken up immediately, which eventually triggers kernel hung panic.  Since previous patch has replaced hinic_dev.tx_stats/rx_stats with local variable in hinic_get_stats64(), there is nothing need to be protected by lock, so just removing down()/up() is ok.",
  "id": "DEBIAN-CVE-2022-50174",
  "modified": "2026-09-01T19:48:36.756060336Z",
  "published": "2025-06-18T11:15:47.770Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2022-50174"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2022-50174"
  ]
}