GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50363 (GCVE-0-2022-50363)

Vulnerability from cvelistv5 – Published: 2025-09-17 14:56 – Updated: 2026-08-05 08:58
VLAI
Title
skmsg: pass gfp argument to alloc_sk_msg()
Summary
In the Linux kernel, the following vulnerability has been resolved: skmsg: pass gfp argument to alloc_sk_msg() syzbot found that alloc_sk_msg() could be called from a non sleepable context. sk_psock_verdict_recv() uses rcu_read_lock() protection. We need the callers to pass a gfp_t argument to avoid issues. syzbot report was: BUG: sleeping function called from invalid context at include/linux/sched/mm.h:274 in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 3613, name: syz-executor414 preempt_count: 0, expected: 0 RCU nest depth: 1, expected: 0 INFO: lockdep is turned off. CPU: 0 PID: 3613 Comm: syz-executor414 Not tainted 6.0.0-syzkaller-09589-g55be6084c8e0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106 __might_resched+0x538/0x6a0 kernel/sched/core.c:9877 might_alloc include/linux/sched/mm.h:274 [inline] slab_pre_alloc_hook mm/slab.h:700 [inline] slab_alloc_node mm/slub.c:3162 [inline] slab_alloc mm/slub.c:3256 [inline] kmem_cache_alloc_trace+0x59/0x310 mm/slub.c:3287 kmalloc include/linux/slab.h:600 [inline] kzalloc include/linux/slab.h:733 [inline] alloc_sk_msg net/core/skmsg.c:507 [inline] sk_psock_skb_ingress_self+0x5c/0x330 net/core/skmsg.c:600 sk_psock_verdict_apply+0x395/0x440 net/core/skmsg.c:1014 sk_psock_verdict_recv+0x34d/0x560 net/core/skmsg.c:1201 tcp_read_skb+0x4a1/0x790 net/ipv4/tcp.c:1770 tcp_rcv_established+0x129d/0x1a10 net/ipv4/tcp_input.c:5971 tcp_v4_do_rcv+0x479/0xac0 net/ipv4/tcp_ipv4.c:1681 sk_backlog_rcv include/net/sock.h:1109 [inline] __release_sock+0x1d8/0x4c0 net/core/sock.c:2906 release_sock+0x5d/0x1c0 net/core/sock.c:3462 tcp_sendmsg+0x36/0x40 net/ipv4/tcp.c:1483 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] __sys_sendto+0x46d/0x5f0 net/socket.c:2117 __do_sys_sendto net/socket.c:2129 [inline] __se_sys_sendto net/socket.c:2125 [inline] __x64_sys_sendto+0xda/0xf0 net/socket.c:2125 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 18:34 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 43312915b5ba20741617dd2119e835205fa8580c , < 693ddd6ffc05b228ea1638f9d757c5d3541f9446 (git)
Affected: 43312915b5ba20741617dd2119e835205fa8580c , < 2d1f274b95c6e4ba6a813b3b8e7a1a38d54a0a08 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.0.6 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-50363",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:34:03.419922Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T18:42:58.567Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/skmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "693ddd6ffc05b228ea1638f9d757c5d3541f9446",
              "status": "affected",
              "version": "43312915b5ba20741617dd2119e835205fa8580c",
              "versionType": "git"
            },
            {
              "lessThan": "2d1f274b95c6e4ba6a813b3b8e7a1a38d54a0a08",
              "status": "affected",
              "version": "43312915b5ba20741617dd2119e835205fa8580c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/skmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.6",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nskmsg: pass gfp argument to alloc_sk_msg()\n\nsyzbot found that alloc_sk_msg() could be called from a\nnon sleepable context. sk_psock_verdict_recv() uses\nrcu_read_lock() protection.\n\nWe need the callers to pass a gfp_t argument to avoid issues.\n\nsyzbot report was:\n\nBUG: sleeping function called from invalid context at include/linux/sched/mm.h:274\nin_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 3613, name: syz-executor414\npreempt_count: 0, expected: 0\nRCU nest depth: 1, expected: 0\nINFO: lockdep is turned off.\nCPU: 0 PID: 3613 Comm: syz-executor414 Not tainted 6.0.0-syzkaller-09589-g55be6084c8e0 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022\nCall Trace:\n\u003cTASK\u003e\n__dump_stack lib/dump_stack.c:88 [inline]\ndump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106\n__might_resched+0x538/0x6a0 kernel/sched/core.c:9877\nmight_alloc include/linux/sched/mm.h:274 [inline]\nslab_pre_alloc_hook mm/slab.h:700 [inline]\nslab_alloc_node mm/slub.c:3162 [inline]\nslab_alloc mm/slub.c:3256 [inline]\nkmem_cache_alloc_trace+0x59/0x310 mm/slub.c:3287\nkmalloc include/linux/slab.h:600 [inline]\nkzalloc include/linux/slab.h:733 [inline]\nalloc_sk_msg net/core/skmsg.c:507 [inline]\nsk_psock_skb_ingress_self+0x5c/0x330 net/core/skmsg.c:600\nsk_psock_verdict_apply+0x395/0x440 net/core/skmsg.c:1014\nsk_psock_verdict_recv+0x34d/0x560 net/core/skmsg.c:1201\ntcp_read_skb+0x4a1/0x790 net/ipv4/tcp.c:1770\ntcp_rcv_established+0x129d/0x1a10 net/ipv4/tcp_input.c:5971\ntcp_v4_do_rcv+0x479/0xac0 net/ipv4/tcp_ipv4.c:1681\nsk_backlog_rcv include/net/sock.h:1109 [inline]\n__release_sock+0x1d8/0x4c0 net/core/sock.c:2906\nrelease_sock+0x5d/0x1c0 net/core/sock.c:3462\ntcp_sendmsg+0x36/0x40 net/ipv4/tcp.c:1483\nsock_sendmsg_nosec net/socket.c:714 [inline]\nsock_sendmsg net/socket.c:734 [inline]\n__sys_sendto+0x46d/0x5f0 net/socket.c:2117\n__do_sys_sendto net/socket.c:2129 [inline]\n__se_sys_sendto net/socket.c:2125 [inline]\n__x64_sys_sendto+0xda/0xf0 net/socket.c:2125\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\ndo_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80\nentry_SYSCALL_64_after_hwframe+0x63/0xcd"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug sits in sk_psock_verdict_recv on the TCP receive path (tcp_rcv_established \u2192 tcp_read_skb / backlog \u2192 verdict \u2192 sk_psock_skb_ingress_self). On sockmap/sockhash sockets with a stream/skb verdict program, remote TCP payload delivery triggers the GFP_KERNEL allocation under rcu_read_lock.\nAC:L - Once a SOCKMAP/SOCKHASH verdict attachment is present (common with Cilium-style sockmap), the attacker reliably drives the path by sending TCP data; no race or attacker-uncontrollable condition is required to hit the illegal sleep.\nPR:N - Creating sockmap requires CAP_NET_ADMIN in the init user namespace, but exploitation against an already-configured sockmap service needs no privileges or authentication\u2014only the ability to send TCP data to the mapped socket.\nUI:N - Packet delivery and socket backlog processing invoke the vulnerable path automatically; no victim user action is required.\nS:U - Impact remains within the host kernel\u2019s authority (DoS / potential RCU UAF on sk_psock); there is no VM, IOMMU, or other security-authority boundary crossing.\nC:H - Sleeping under rcu_read_lock while holding the RCU-protected sk_psock can allow grace periods to complete incorrectly on non-PREEMPT_RCU kernels, yielding a use-after-free of sk_psock (freed via RCU work), which enables disclosure of freed object contents.\nI:H - The same RCU-break UAF on sk_psock is exploitable for heap reuse and control-flow/data integrity compromise, not merely a clean failure.\nA:H - GFP_KERNEL under rcu_read_lock can stall RCU, hang under reclaim, or crash via UAF\u2014any of which is a high availability impact on the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:58:23.954Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/693ddd6ffc05b228ea1638f9d757c5d3541f9446"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d1f274b95c6e4ba6a813b3b8e7a1a38d54a0a08"
        }
      ],
      "title": "skmsg: pass gfp argument to alloc_sk_msg()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50363",
    "datePublished": "2025-09-17T14:56:15.047Z",
    "dateReserved": "2025-09-17T14:53:06.994Z",
    "dateUpdated": "2026-08-05T08:58:23.954Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50363",
      "date": "2026-09-15",
      "epss": "0.00399",
      "percentile": "0.33564"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50363\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-17T15:15:35.107\",\"lastModified\":\"2026-08-04T10:18:12.970\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nskmsg: pass gfp argument to alloc_sk_msg()\\n\\nsyzbot found that alloc_sk_msg() could be called from a\\nnon sleepable context. sk_psock_verdict_recv() uses\\nrcu_read_lock() protection.\\n\\nWe need the callers to pass a gfp_t argument to avoid issues.\\n\\nsyzbot report was:\\n\\nBUG: sleeping function called from invalid context at include/linux/sched/mm.h:274\\nin_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 3613, name: syz-executor414\\npreempt_count: 0, expected: 0\\nRCU nest depth: 1, expected: 0\\nINFO: lockdep is turned off.\\nCPU: 0 PID: 3613 Comm: syz-executor414 Not tainted 6.0.0-syzkaller-09589-g55be6084c8e0 #0\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022\\nCall Trace:\\n\u003cTASK\u003e\\n__dump_stack lib/dump_stack.c:88 [inline]\\ndump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106\\n__might_resched+0x538/0x6a0 kernel/sched/core.c:9877\\nmight_alloc include/linux/sched/mm.h:274 [inline]\\nslab_pre_alloc_hook mm/slab.h:700 [inline]\\nslab_alloc_node mm/slub.c:3162 [inline]\\nslab_alloc mm/slub.c:3256 [inline]\\nkmem_cache_alloc_trace+0x59/0x310 mm/slub.c:3287\\nkmalloc include/linux/slab.h:600 [inline]\\nkzalloc include/linux/slab.h:733 [inline]\\nalloc_sk_msg net/core/skmsg.c:507 [inline]\\nsk_psock_skb_ingress_self+0x5c/0x330 net/core/skmsg.c:600\\nsk_psock_verdict_apply+0x395/0x440 net/core/skmsg.c:1014\\nsk_psock_verdict_recv+0x34d/0x560 net/core/skmsg.c:1201\\ntcp_read_skb+0x4a1/0x790 net/ipv4/tcp.c:1770\\ntcp_rcv_established+0x129d/0x1a10 net/ipv4/tcp_input.c:5971\\ntcp_v4_do_rcv+0x479/0xac0 net/ipv4/tcp_ipv4.c:1681\\nsk_backlog_rcv include/net/sock.h:1109 [inline]\\n__release_sock+0x1d8/0x4c0 net/core/sock.c:2906\\nrelease_sock+0x5d/0x1c0 net/core/sock.c:3462\\ntcp_sendmsg+0x36/0x40 net/ipv4/tcp.c:1483\\nsock_sendmsg_nosec net/socket.c:714 [inline]\\nsock_sendmsg net/socket.c:734 [inline]\\n__sys_sendto+0x46d/0x5f0 net/socket.c:2117\\n__do_sys_sendto net/socket.c:2129 [inline]\\n__se_sys_sendto net/socket.c:2125 [inline]\\n__x64_sys_sendto+0xda/0xf0 net/socket.c:2125\\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\\ndo_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80\\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/core/skmsg.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"43312915b5ba20741617dd2119e835205fa8580c\",\"lessThan\":\"693ddd6ffc05b228ea1638f9d757c5d3541f9446\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"43312915b5ba20741617dd2119e835205fa8580c\",\"lessThan\":\"2d1f274b95c6e4ba6a813b3b8e7a1a38d54a0a08\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/core/skmsg.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0.6\",\"lessThanOrEqual\":\"6.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-01-14T18:34:03.419922Z\",\"id\":\"CVE-2022-50363\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0\",\"versionEndExcluding\":\"6.0.6\",\"matchCriteriaId\":\"72254368-5250-4CC5-9EFB-2F4EB5E9BA4D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E7E331DA-1FB0-4DEC-91AC-7DA69D461C11\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2d1f274b95c6e4ba6a813b3b8e7a1a38d54a0a08\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/693ddd6ffc05b228ea1638f9d757c5d3541f9446\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T21:48:42+00:00",
      "cve": "CVE-2022-50363",
      "id": "CVE-2022-50363",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "201",
      "product_status:known_not_affected": "188",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: skmsg: pass gfp argument to alloc_sk_msg()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50363.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T02:21:37Z",
      "cve": "CVE-2022-50363",
      "id": "CVE-2022-50363",
      "initial_release_date": "2025-09-17T23:30:55Z",
      "product_status:known_not_affected": "523",
      "product_status:recommended": "27",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50363",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50363.json",
      "version": "12"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-50363\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-14T18:34:03.419922Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-14T18:33:58.592Z\"}}], \"cna\": {\"title\": \"skmsg: pass gfp argument to alloc_sk_msg()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"43312915b5ba20741617dd2119e835205fa8580c\", \"lessThan\": \"693ddd6ffc05b228ea1638f9d757c5d3541f9446\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"43312915b5ba20741617dd2119e835205fa8580c\", \"lessThan\": \"2d1f274b95c6e4ba6a813b3b8e7a1a38d54a0a08\", \"versionType\": \"git\"}], \"programFiles\": [\"net/core/skmsg.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.0\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.0.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.0.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/core/skmsg.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/693ddd6ffc05b228ea1638f9d757c5d3541f9446\"}, {\"url\": \"https://git.kernel.org/stable/c/2d1f274b95c6e4ba6a813b3b8e7a1a38d54a0a08\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nskmsg: pass gfp argument to alloc_sk_msg()\\n\\nsyzbot found that alloc_sk_msg() could be called from a\\nnon sleepable context. sk_psock_verdict_recv() uses\\nrcu_read_lock() protection.\\n\\nWe need the callers to pass a gfp_t argument to avoid issues.\\n\\nsyzbot report was:\\n\\nBUG: sleeping function called from invalid context at include/linux/sched/mm.h:274\\nin_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 3613, name: syz-executor414\\npreempt_count: 0, expected: 0\\nRCU nest depth: 1, expected: 0\\nINFO: lockdep is turned off.\\nCPU: 0 PID: 3613 Comm: syz-executor414 Not tainted 6.0.0-syzkaller-09589-g55be6084c8e0 #0\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022\\nCall Trace:\\n\u003cTASK\u003e\\n__dump_stack lib/dump_stack.c:88 [inline]\\ndump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106\\n__might_resched+0x538/0x6a0 kernel/sched/core.c:9877\\nmight_alloc include/linux/sched/mm.h:274 [inline]\\nslab_pre_alloc_hook mm/slab.h:700 [inline]\\nslab_alloc_node mm/slub.c:3162 [inline]\\nslab_alloc mm/slub.c:3256 [inline]\\nkmem_cache_alloc_trace+0x59/0x310 mm/slub.c:3287\\nkmalloc include/linux/slab.h:600 [inline]\\nkzalloc include/linux/slab.h:733 [inline]\\nalloc_sk_msg net/core/skmsg.c:507 [inline]\\nsk_psock_skb_ingress_self+0x5c/0x330 net/core/skmsg.c:600\\nsk_psock_verdict_apply+0x395/0x440 net/core/skmsg.c:1014\\nsk_psock_verdict_recv+0x34d/0x560 net/core/skmsg.c:1201\\ntcp_read_skb+0x4a1/0x790 net/ipv4/tcp.c:1770\\ntcp_rcv_established+0x129d/0x1a10 net/ipv4/tcp_input.c:5971\\ntcp_v4_do_rcv+0x479/0xac0 net/ipv4/tcp_ipv4.c:1681\\nsk_backlog_rcv include/net/sock.h:1109 [inline]\\n__release_sock+0x1d8/0x4c0 net/core/sock.c:2906\\nrelease_sock+0x5d/0x1c0 net/core/sock.c:3462\\ntcp_sendmsg+0x36/0x40 net/ipv4/tcp.c:1483\\nsock_sendmsg_nosec net/socket.c:714 [inline]\\nsock_sendmsg net/socket.c:734 [inline]\\n__sys_sendto+0x46d/0x5f0 net/socket.c:2117\\n__do_sys_sendto net/socket.c:2129 [inline]\\n__se_sys_sendto net/socket.c:2125 [inline]\\n__x64_sys_sendto+0xda/0xf0 net/socket.c:2125\\ndo_syscall_x64 arch/x86/entry/common.c:50 [inline]\\ndo_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80\\nentry_SYSCALL_64_after_hwframe+0x63/0xcd\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.0.6\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1\", \"versionStartIncluding\": \"6.0\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T19:18:06.530Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-50363\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T19:18:06.530Z\", \"dateReserved\": \"2025-09-17T14:53:06.994Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-09-17T14:56:15.047Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.