# CVE-2022-50008: kprobes: don't call disarm_kprobe() for disabled kprobes

Status: published. Published: 2025-06-18. Updated: 2026-11-05.

In the Linux kernel, the following vulnerability has been resolved:

kprobes: don't call disarm_kprobe() for disabled kprobes

The assumption in __disable_kprobe() is wrong, and it could try to disarm
an already disarmed kprobe and fire the WARN_ONCE() below. [0]  We can
easily reproduce this issue.

1. Write 0 to /sys/kernel/debug/kprobes/enabled.

  # echo 0 > /sys/kernel/debug/kprobes/enabled

2. Run execsnoop.  At this time, one kprobe is disabled.

  # /usr/share/bcc/tools/execsnoop &
  [1] 2460
  PCOMM            PID    PPID   RET ARGS

  # cat /sys/kernel/debug/kprobes/list
  ffffffff91345650  r  __x64_sys_execve+0x0    [FTRACE]
  ffffffff91345650  k  __x64_sys_execve+0x0    [DISABLED][FTRACE]

3. Write 1 to /sys/kernel/debug/kprobes/enabled, which changes
   kprobes_all_disarmed to false but does not arm the disabled kprobe.

  # echo 1 > /sys/kernel/debug/kprobes/enabled

  # cat /sys/kernel/debug/kprobes/list
  ffffffff91345650  r  __x64_sys_execve+0x0    [FTRACE]
  ffffffff91345650  k  __x64_sys_execve+0x0    [DISABLED][FTRACE]

4. Kill execsnoop, when __disable_kprobe() calls disarm_kprobe() for the
   disabled kprobe and hits the WARN_ONCE() in __disarm_kprobe_ftrace().

  # fg
  /usr/share/bcc/tools/execsnoop
  ^C

Actually, WARN_ONCE() is fired twice, and __unregister_kprobe_top() misses
some cleanups and leaves the aggregated kprobe in the hash table.  Then,
__unregister_trace_kprobe() initialises tk->rp.kp.list and creates an
infinite loop like this.

  aggregated kprobe.list -> kprobe.list -.
                                     ^    |
                                     '.__.'

In this situation, these commands fall into the infinite loop and result
in RCU stall or soft lockup.

  cat /sys/kernel/debug/kprobes/list : show_kprobe_addr() enters into the
                                       infinite loop with RCU.

  /usr/share/bcc/tools/execsnoop : warn_kprobe_rereg() holds kprobe_mutex,
                                   and __get_valid_kprobe() is stuck in
				   the loop.

To avoid the issue, make sure we don't call disarm_kprobe() for disabled
kprobes.

[0]
Failed to disarm kprobe-ftrace at __x64_sys_execve+0x0/0x40 (error -2)
WARNING: CPU: 6 PID: 2460 at kernel/kprobes.c:1130 __disarm_kprobe_ftrace.isra.19 (kernel/kprobes.c:1129)
Modules linked in: ena
CPU: 6 PID: 2460 Comm: execsnoop Not tainted 5.19.0+ #28
Hardware name: Amazon EC2 c5.2xlarge/, BIOS 1.0 10/16/2017
RIP: 0010:__disarm_kprobe_ftrace.isra.19 (kernel/kprobes.c:1129)
Code: 24 8b 02 eb c1 80 3d c4 83 f2 01 00 75 d4 48 8b 75 00 89 c2 48 c7 c7 90 fa 0f 92 89 04 24 c6 05 ab 83 01 e8 e4 94 f0 ff <0f> 0b 8b 04 24 eb b1 89 c6 48 c7 c7 60 fa 0f 92 89 04 24 e8 cc 94
RSP: 0018:ffff9e6ec154bd98 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffffffff930f7b00 RCX: 0000000000000001
RDX: 0000000080000001 RSI: ffffffff921461c5 RDI: 00000000ffffffff
RBP: ffff89c504286da8 R08: 0000000000000000 R09: c0000000fffeffff
R10: 0000000000000000 R11: ffff9e6ec154bc28 R12: ffff89c502394e40
R13: ffff89c502394c00 R14: ffff9e6ec154bc00 R15: 0000000000000000
FS:  00007fe800398740(0000) GS:ffff89c812d80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c00057f010 CR3: 0000000103b54006 CR4: 00000000007706e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
<TASK>
 __disable_kprobe (kernel/kprobes.c:1716)
 disable_kprobe (kernel/kprobes.c:2392)
 __disable_trace_kprobe (kernel/trace/trace_kprobe.c:340)
 disable_trace_kprobe (kernel/trace/trace_kprobe.c:429)
 perf_trace_event_unreg.isra.2 (./include/linux/tracepoint.h:93 kernel/trace/trace_event_perf.c:168)
 perf_kprobe_destroy (kernel/trace/trace_event_perf.c:295)
 _free_event (kernel/events/core.c:4971)
 perf_event_release_kernel (kernel/events/core.c:5176)
 perf_release (kernel/events/core.c:5186)
 __fput (fs/file_table.c:321)
 task_work_run (./include/linux/
---truncated---

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Linux / Linux: ≥ 69d54b916d83872a0a327778a01af2a096923f59; < 19cd630712e7c13a3dedfc6986a9b983fed6fd98 (affected, git); ≥ 69d54b916d83872a0a327778a01af2a096923f59; < 6f3c1bc22fc2165461883f506b4d2c3594bd7137 (affected, git); ≥ 69d54b916d83872a0a327778a01af2a096923f59; < fc91d2db55acdaf0c0075b624e572d3520ca3bc3 (affected, git); ≥ 69d54b916d83872a0a327778a01af2a096923f59; < b474ff1b20951f1eac75d100a93861e6da2b522b (affected, git); ≥ 69d54b916d83872a0a327778a01af2a096923f59; < 744b0d3080709a172f0408aedabd1cedd24c2ee6 (affected, git); ≥ 69d54b916d83872a0a327778a01af2a096923f59; < 55c7a91527343d2e0b5647cc308c6e04ddd2aa52 (affected, git); ≥ 69d54b916d83872a0a327778a01af2a096923f59; < bc3188d8a3b8c08c306a4c851ddb2c92ba4599ca (affected, git); ≥ 69d54b916d83872a0a327778a01af2a096923f59; < 9c80e79906b4ca440d09e7f116609262bb747909 (affected, git). Source: CNA: Linux
- Linux / Linux: 4.0 (affected); ≥ 0; < 4.0 (unaffected, semver); ≥ 4.9.327; ≤ 4.9.* (unaffected, semver); ≥ 4.14.292; ≤ 4.14.* (unaffected, semver); ≥ 4.19.257; ≤ 4.19.* (unaffected, semver); ≥ 5.4.212; ≤ 5.4.* (unaffected, semver); ≥ 5.10.141; ≤ 5.10.* (unaffected, semver); ≥ 5.15.65; ≤ 5.15.* (unaffected, semver); ≥ 5.19.6; ≤ 5.19.* (unaffected, semver); ≥ 6.0; ≤ * (unaffected, original_commit_for_fix). Source: CNA: Linux

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: 0.25% as of 2026-11-05; percentile 16.95%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: Not reported

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://git.kernel.org/stable/c/19cd630712e7c13a3dedfc6986a9b983fed6fd98 (CNA: Linux)

- https://git.kernel.org/stable/c/6f3c1bc22fc2165461883f506b4d2c3594bd7137 (CNA: Linux)

- https://git.kernel.org/stable/c/fc91d2db55acdaf0c0075b624e572d3520ca3bc3 (CNA: Linux)

- https://git.kernel.org/stable/c/b474ff1b20951f1eac75d100a93861e6da2b522b (CNA: Linux)

- https://git.kernel.org/stable/c/744b0d3080709a172f0408aedabd1cedd24c2ee6 (CNA: Linux)

- https://git.kernel.org/stable/c/55c7a91527343d2e0b5647cc308c6e04ddd2aa52 (CNA: Linux)

- https://git.kernel.org/stable/c/bc3188d8a3b8c08c306a4c851ddb2c92ba4599ca (CNA: Linux)

- https://git.kernel.org/stable/c/9c80e79906b4ca440d09e7f116609262bb747909 (CNA: Linux)

## Provenance

- CNA: Linux: https://www.cve.org/CVERecord?id=CVE-2022-50008; retrieved 2026-11-05; source updated 2026-11-05

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2022-50008; retrieved 2026-11-05; source updated Not reported

Revision: ed23b285c5fbd884de0e3399eb0814e63fd19d09ced5345da4bf4fbcca51d20c

Canonical: https://y2.dev/cve/CVE-2022-50008

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.