CVE-2022-50409
BaseFortify
Publication date: 2025-09-18
Last updated on: 2025-12-11
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | to 4.14.296 (exc) |
| linux | linux_kernel | From 4.15 (inc) to 4.19.262 (exc) |
| linux | linux_kernel | From 4.20 (inc) to 5.4.220 (exc) |
| linux | linux_kernel | From 5.5 (inc) to 5.10.150 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.75 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 5.19.17 (exc) |
| linux | linux_kernel | From 6.0 (inc) to 6.0.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a NULL pointer dereference in the Linux kernel's networking code. It occurs when one thread is waiting for memory on a socket while another thread closes the same socket, causing the socket's wait queue pointer (sk_wq) to become NULL. The waiting thread then tries to access this NULL pointer, leading to a kernel crash. The root cause is that the socket's reference count is not properly increased during certain operations, allowing the socket to be released while still in use. The fix involves checking if the socket is marked as dead (SOCK_DEAD flag) before accessing its wait queue.
How can this vulnerability impact me? :
This vulnerability can cause a kernel crash (NULL pointer dereference) leading to a denial of service (DoS) on affected Linux systems. If exploited, it could disrupt network operations or cause system instability by crashing the kernel when certain socket operations occur concurrently.
What immediate steps should I take to mitigate this vulnerability?
Apply the patch or update to a Linux kernel version that includes the fix for this vulnerability, which ensures that the SOCK_DEAD flag is checked before accessing the socket's wait queue in sk_stream_wait_memory. Avoid using vulnerable kernel versions until patched.