GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50409 (GCVE-0-2022-50409)

Vulnerability from cvelistv5 – Published: 2025-09-18 16:03 – Updated: 2026-05-11 19:18
VLAI
Title
net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory
Summary
In the Linux kernel, the following vulnerability has been resolved: net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory Fixes the below NULL pointer dereference: [...] [ 14.471200] Call Trace: [ 14.471562] <TASK> [ 14.471882] lock_acquire+0x245/0x2e0 [ 14.472416] ? remove_wait_queue+0x12/0x50 [ 14.473014] ? _raw_spin_lock_irqsave+0x17/0x50 [ 14.473681] _raw_spin_lock_irqsave+0x3d/0x50 [ 14.474318] ? remove_wait_queue+0x12/0x50 [ 14.474907] remove_wait_queue+0x12/0x50 [ 14.475480] sk_stream_wait_memory+0x20d/0x340 [ 14.476127] ? do_wait_intr_irq+0x80/0x80 [ 14.476704] do_tcp_sendpages+0x287/0x600 [ 14.477283] tcp_bpf_push+0xab/0x260 [ 14.477817] tcp_bpf_sendmsg_redir+0x297/0x500 [ 14.478461] ? __local_bh_enable_ip+0x77/0xe0 [ 14.479096] tcp_bpf_send_verdict+0x105/0x470 [ 14.479729] tcp_bpf_sendmsg+0x318/0x4f0 [ 14.480311] sock_sendmsg+0x2d/0x40 [ 14.480822] ____sys_sendmsg+0x1b4/0x1c0 [ 14.481390] ? copy_msghdr_from_user+0x62/0x80 [ 14.482048] ___sys_sendmsg+0x78/0xb0 [ 14.482580] ? vmf_insert_pfn_prot+0x91/0x150 [ 14.483215] ? __do_fault+0x2a/0x1a0 [ 14.483738] ? do_fault+0x15e/0x5d0 [ 14.484246] ? __handle_mm_fault+0x56b/0x1040 [ 14.484874] ? lock_is_held_type+0xdf/0x130 [ 14.485474] ? find_held_lock+0x2d/0x90 [ 14.486046] ? __sys_sendmsg+0x41/0x70 [ 14.486587] __sys_sendmsg+0x41/0x70 [ 14.487105] ? intel_pmu_drain_pebs_core+0x350/0x350 [ 14.487822] do_syscall_64+0x34/0x80 [ 14.488345] entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] The test scenario has the following flow: thread1 thread2 ----------- --------------- tcp_bpf_sendmsg tcp_bpf_send_verdict tcp_bpf_sendmsg_redir sock_close tcp_bpf_push_locked __sock_release tcp_bpf_push //inet_release do_tcp_sendpages sock->ops->release sk_stream_wait_memory // tcp_close sk_wait_event sk->sk_prot->close release_sock(__sk); *** lock_sock(sk); __tcp_close sock_orphan(sk) sk->sk_wq = NULL release_sock **** lock_sock(__sk); remove_wait_queue(sk_sleep(sk), &wait); sk_sleep(sk) //NULL pointer dereference &rcu_dereference_raw(sk->sk_wq)->wait While waiting for memory in thread1, the socket is released with its wait queue because thread2 has closed it. This caused by tcp_bpf_send_verdict didn't increase the f_count of psock->sk_redir->sk_socket->file in thread1. We should check if SOCK_DEAD flag is set on wakeup in sk_stream_wait_memory before accessing the wait queue.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < a76462dbdd8bddcbeec9463bc9e54e509b860762 (git)
Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < 65029aaedd15d9fe5ea1a899134e236d83f627bb (git)
Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < 124b7c773271f06af5a2cea694b283cdb5275cf5 (git)
Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < 35f5e70bdfa7432762ac4ffa75e5a7574ac5563e (git)
Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < 435f5aa4421782af197b98d8525263977be4af5c (git)
Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < 3f8ef65af927db247418d4e1db49164d7a158fc5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.20
Unaffected: 0 , < 4.20 (semver)
Unaffected: 5.4.220 , ≤ 5.4.* (semver)
Unaffected: 5.10.150 , ≤ 5.10.* (semver)
Unaffected: 5.15.75 , ≤ 5.15.* (semver)
Unaffected: 5.19.17 , ≤ 5.19.* (semver)
Unaffected: 6.0.3 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/stream.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a76462dbdd8bddcbeec9463bc9e54e509b860762",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "65029aaedd15d9fe5ea1a899134e236d83f627bb",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "124b7c773271f06af5a2cea694b283cdb5275cf5",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "35f5e70bdfa7432762ac4ffa75e5a7574ac5563e",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "435f5aa4421782af197b98d8525263977be4af5c",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "3f8ef65af927db247418d4e1db49164d7a158fc5",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/stream.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.220",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.150",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.220",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.150",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.75",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.17",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.3",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: If sock is dead don\u0027t access sock\u0027s sk_wq in sk_stream_wait_memory\n\nFixes the below NULL pointer dereference:\n\n  [...]\n  [   14.471200] Call Trace:\n  [   14.471562]  \u003cTASK\u003e\n  [   14.471882]  lock_acquire+0x245/0x2e0\n  [   14.472416]  ? remove_wait_queue+0x12/0x50\n  [   14.473014]  ? _raw_spin_lock_irqsave+0x17/0x50\n  [   14.473681]  _raw_spin_lock_irqsave+0x3d/0x50\n  [   14.474318]  ? remove_wait_queue+0x12/0x50\n  [   14.474907]  remove_wait_queue+0x12/0x50\n  [   14.475480]  sk_stream_wait_memory+0x20d/0x340\n  [   14.476127]  ? do_wait_intr_irq+0x80/0x80\n  [   14.476704]  do_tcp_sendpages+0x287/0x600\n  [   14.477283]  tcp_bpf_push+0xab/0x260\n  [   14.477817]  tcp_bpf_sendmsg_redir+0x297/0x500\n  [   14.478461]  ? __local_bh_enable_ip+0x77/0xe0\n  [   14.479096]  tcp_bpf_send_verdict+0x105/0x470\n  [   14.479729]  tcp_bpf_sendmsg+0x318/0x4f0\n  [   14.480311]  sock_sendmsg+0x2d/0x40\n  [   14.480822]  ____sys_sendmsg+0x1b4/0x1c0\n  [   14.481390]  ? copy_msghdr_from_user+0x62/0x80\n  [   14.482048]  ___sys_sendmsg+0x78/0xb0\n  [   14.482580]  ? vmf_insert_pfn_prot+0x91/0x150\n  [   14.483215]  ? __do_fault+0x2a/0x1a0\n  [   14.483738]  ? do_fault+0x15e/0x5d0\n  [   14.484246]  ? __handle_mm_fault+0x56b/0x1040\n  [   14.484874]  ? lock_is_held_type+0xdf/0x130\n  [   14.485474]  ? find_held_lock+0x2d/0x90\n  [   14.486046]  ? __sys_sendmsg+0x41/0x70\n  [   14.486587]  __sys_sendmsg+0x41/0x70\n  [   14.487105]  ? intel_pmu_drain_pebs_core+0x350/0x350\n  [   14.487822]  do_syscall_64+0x34/0x80\n  [   14.488345]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n  [...]\n\nThe test scenario has the following flow:\n\nthread1                               thread2\n-----------                           ---------------\n tcp_bpf_sendmsg\n  tcp_bpf_send_verdict\n   tcp_bpf_sendmsg_redir              sock_close\n    tcp_bpf_push_locked                 __sock_release\n     tcp_bpf_push                         //inet_release\n      do_tcp_sendpages                    sock-\u003eops-\u003erelease\n       sk_stream_wait_memory          \t   // tcp_close\n          sk_wait_event                      sk-\u003esk_prot-\u003eclose\n           release_sock(__sk);\n            ***\n                                                lock_sock(sk);\n                                                  __tcp_close\n                                                    sock_orphan(sk)\n                                                      sk-\u003esk_wq  = NULL\n                                                release_sock\n            ****\n           lock_sock(__sk);\n          remove_wait_queue(sk_sleep(sk), \u0026wait);\n             sk_sleep(sk)\n             //NULL pointer dereference\n             \u0026rcu_dereference_raw(sk-\u003esk_wq)-\u003ewait\n\nWhile waiting for memory in thread1, the socket is released with its wait\nqueue because thread2 has closed it. This caused by tcp_bpf_send_verdict\ndidn\u0027t increase the f_count of psock-\u003esk_redir-\u003esk_socket-\u003efile in thread1.\n\nWe should check if SOCK_DEAD flag is set on wakeup in sk_stream_wait_memory\nbefore accessing the wait queue."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:18:56.170Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a76462dbdd8bddcbeec9463bc9e54e509b860762"
        },
        {
          "url": "https://git.kernel.org/stable/c/65029aaedd15d9fe5ea1a899134e236d83f627bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/124b7c773271f06af5a2cea694b283cdb5275cf5"
        },
        {
          "url": "https://git.kernel.org/stable/c/35f5e70bdfa7432762ac4ffa75e5a7574ac5563e"
        },
        {
          "url": "https://git.kernel.org/stable/c/435f5aa4421782af197b98d8525263977be4af5c"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f8ef65af927db247418d4e1db49164d7a158fc5"
        }
      ],
      "title": "net: If sock is dead don\u0027t access sock\u0027s sk_wq in sk_stream_wait_memory",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50409",
    "datePublished": "2025-09-18T16:03:53.902Z",
    "dateReserved": "2025-09-17T14:53:07.001Z",
    "dateUpdated": "2026-05-11T19:18:56.170Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50409",
      "date": "2026-09-14",
      "epss": "0.00156",
      "percentile": "0.05103"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50409\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-18T16:15:44.133\",\"lastModified\":\"2026-06-17T05:23:29.013\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: If sock is dead don\u0027t access sock\u0027s sk_wq in sk_stream_wait_memory\\n\\nFixes the below NULL pointer dereference:\\n\\n  [...]\\n  [   14.471200] Call Trace:\\n  [   14.471562]  \u003cTASK\u003e\\n  [   14.471882]  lock_acquire+0x245/0x2e0\\n  [   14.472416]  ? remove_wait_queue+0x12/0x50\\n  [   14.473014]  ? _raw_spin_lock_irqsave+0x17/0x50\\n  [   14.473681]  _raw_spin_lock_irqsave+0x3d/0x50\\n  [   14.474318]  ? remove_wait_queue+0x12/0x50\\n  [   14.474907]  remove_wait_queue+0x12/0x50\\n  [   14.475480]  sk_stream_wait_memory+0x20d/0x340\\n  [   14.476127]  ? do_wait_intr_irq+0x80/0x80\\n  [   14.476704]  do_tcp_sendpages+0x287/0x600\\n  [   14.477283]  tcp_bpf_push+0xab/0x260\\n  [   14.477817]  tcp_bpf_sendmsg_redir+0x297/0x500\\n  [   14.478461]  ? __local_bh_enable_ip+0x77/0xe0\\n  [   14.479096]  tcp_bpf_send_verdict+0x105/0x470\\n  [   14.479729]  tcp_bpf_sendmsg+0x318/0x4f0\\n  [   14.480311]  sock_sendmsg+0x2d/0x40\\n  [   14.480822]  ____sys_sendmsg+0x1b4/0x1c0\\n  [   14.481390]  ? copy_msghdr_from_user+0x62/0x80\\n  [   14.482048]  ___sys_sendmsg+0x78/0xb0\\n  [   14.482580]  ? vmf_insert_pfn_prot+0x91/0x150\\n  [   14.483215]  ? __do_fault+0x2a/0x1a0\\n  [   14.483738]  ? do_fault+0x15e/0x5d0\\n  [   14.484246]  ? __handle_mm_fault+0x56b/0x1040\\n  [   14.484874]  ? lock_is_held_type+0xdf/0x130\\n  [   14.485474]  ? find_held_lock+0x2d/0x90\\n  [   14.486046]  ? __sys_sendmsg+0x41/0x70\\n  [   14.486587]  __sys_sendmsg+0x41/0x70\\n  [   14.487105]  ? intel_pmu_drain_pebs_core+0x350/0x350\\n  [   14.487822]  do_syscall_64+0x34/0x80\\n  [   14.488345]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\\n  [...]\\n\\nThe test scenario has the following flow:\\n\\nthread1                               thread2\\n-----------                           ---------------\\n tcp_bpf_sendmsg\\n  tcp_bpf_send_verdict\\n   tcp_bpf_sendmsg_redir              sock_close\\n    tcp_bpf_push_locked                 __sock_release\\n     tcp_bpf_push                         //inet_release\\n      do_tcp_sendpages                    sock-\u003eops-\u003erelease\\n       sk_stream_wait_memory          \\t   // tcp_close\\n          sk_wait_event                      sk-\u003esk_prot-\u003eclose\\n           release_sock(__sk);\\n            ***\\n                                                lock_sock(sk);\\n                                                  __tcp_close\\n                                                    sock_orphan(sk)\\n                                                      sk-\u003esk_wq  = NULL\\n                                                release_sock\\n            ****\\n           lock_sock(__sk);\\n          remove_wait_queue(sk_sleep(sk), \u0026wait);\\n             sk_sleep(sk)\\n             //NULL pointer dereference\\n             \u0026rcu_dereference_raw(sk-\u003esk_wq)-\u003ewait\\n\\nWhile waiting for memory in thread1, the socket is released with its wait\\nqueue because thread2 has closed it. This caused by tcp_bpf_send_verdict\\ndidn\u0027t increase the f_count of psock-\u003esk_redir-\u003esk_socket-\u003efile in thread1.\\n\\nWe should check if SOCK_DEAD flag is set on wakeup in sk_stream_wait_memory\\nbefore accessing the wait queue.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/core/stream.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"604326b41a6fb9b4a78b6179335decee0365cd8c\",\"lessThan\":\"a76462dbdd8bddcbeec9463bc9e54e509b860762\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"604326b41a6fb9b4a78b6179335decee0365cd8c\",\"lessThan\":\"65029aaedd15d9fe5ea1a899134e236d83f627bb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"604326b41a6fb9b4a78b6179335decee0365cd8c\",\"lessThan\":\"124b7c773271f06af5a2cea694b283cdb5275cf5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"604326b41a6fb9b4a78b6179335decee0365cd8c\",\"lessThan\":\"35f5e70bdfa7432762ac4ffa75e5a7574ac5563e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"604326b41a6fb9b4a78b6179335decee0365cd8c\",\"lessThan\":\"435f5aa4421782af197b98d8525263977be4af5c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"604326b41a6fb9b4a78b6179335decee0365cd8c\",\"lessThan\":\"3f8ef65af927db247418d4e1db49164d7a158fc5\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/core/stream.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.20\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.220\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.150\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.75\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19.17\",\"lessThanOrEqual\":\"5.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0.3\",\"lessThanOrEqual\":\"6.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.14.296\",\"matchCriteriaId\":\"C71AA4D8-A0D5-45D7-A420-247193B5BED7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.262\",\"matchCriteriaId\":\"D6B62970-1FAD-4ED6-930A-23E26A8D2E08\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.220\",\"matchCriteriaId\":\"125F7133-B3B7-4175-8CF3-FF0845483254\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.150\",\"matchCriteriaId\":\"C495821C-2A71-4F09-BED8-6A6EB4C9BA27\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.75\",\"matchCriteriaId\":\"6D945F46-F32F-4C09-8400-C3477E22A9FB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.19.17\",\"matchCriteriaId\":\"19B4C3A4-E5C3-41DC-BB14-BE72858E7D35\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0\",\"versionEndExcluding\":\"6.0.3\",\"matchCriteriaId\":\"5BCD8201-B847-4442-B894-70D430128DEF\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/124b7c773271f06af5a2cea694b283cdb5275cf5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/35f5e70bdfa7432762ac4ffa75e5a7574ac5563e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3f8ef65af927db247418d4e1db49164d7a158fc5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/435f5aa4421782af197b98d8525263977be4af5c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/65029aaedd15d9fe5ea1a899134e236d83f627bb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a76462dbdd8bddcbeec9463bc9e54e509b860762\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T21:49:40+00:00",
      "cve": "CVE-2022-50409",
      "id": "CVE-2022-50409",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: If sock is dead don\u0027t access sock\u0027s sk_wq in sk_stream_wait_memory",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50409.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-31T01:23:57Z",
      "cve": "CVE-2022-50409",
      "id": "CVE-2022-50409",
      "initial_release_date": "2025-09-23T23:33:48Z",
      "product_status:known_affected": "465",
      "product_status:known_not_affected": "159",
      "product_status:recommended": "368",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50409",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50409.json",
      "version": "44"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.