CVE-2022-50071
Linux kernel: information disclosure
- Risk score
- 65/100
- CVSS
- 7.8 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 18 Jun 2025
Open in the live forecast Today's forecast
What to know
- What it is
- A vulnerability in the Linux kernel's mptcp protocol allows an attacker to leak subflows if mptcp socket creation fails due to a CGROUP_INET_SOCK_CREATE eBPF program. This could lead to a high impact, including compromise of confidentiality, integrity, and availability.
- Affected
- {'product': 'Linux kernel', 'affected since': 'before reported root cause commit'}
- Fix
- Check the linked advisory for a fix, as backporting the fix before the reported root cause commit requires a complete rewrite.
- Exploitation
- No known exploitation
Story map
At a glance
Linux kernel: Amber, patch this week. In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6_srh_rcv() runs with skb->data at the Segment Routing Header (SRH) while skb_network_header() points at the IPv6 header. When segments_left > 0, ipv6_srh_rcv() previously restored the …
The flaws
- CVE-2022-50071: Information disclosure (CVSS 7.8 · EPSS 0%)
- CVE-2026-98096: Out-of-bounds write (CVSS 7.4 · EPSS 1%)
- CVE-2026-98115: Race condition (CVSS 8.8 · EPSS 0%)
- CVE-2026-98117: Use-after-free (CVSS 7.8 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Linux kernel
Where it stands
- No known exploitation
How it unfolded
- 3 Nov, Ubuntu security notices (official): USN-8962-1: Linux kernel (Azure CVM) vulnerabilities
- 3 Nov, Ubuntu security notices (official): USN-8963-1: Linux kernel (NVIDIA Tegra) vulnerabilities
- 3 Nov, Ubuntu security notices (official): USN-8961-1: Linux kernel vulnerabilities
Connects to
- Same weakness: Out-of-bounds write (CWE-787). 365 other warnings in 30 days
- Same product: Earlier Linux kernel warnings. 105 in the last 90 days
Why it is Amber
- CVSS 7.8 high
- On your watchlist: linux kernel
- Named in a government or vendor bulletin
Government and vendor bulletins
References
Original description
In the Linux kernel, the following vulnerability has been resolved: mptcp: move subflow cleanup in mptcp_destroy_common() If the mptcp socket creation fails due to a CGROUP_INET_SOCK_CREATE eBPF program, the MPTCP protocol ends-up leaking all the subflows: the related cleanup happens in __mptcp_destroy_sock() that is not invoked in such code path. Address the issue moving the subflow sockets cleanup in the mptcp_destroy_common() helper, which is invoked in every msk cleanup path. Additionally get rid of the intermediate list_splice_init step, which is an unneeded relic from the past. The issue is present since before the reported root cause commit, but any attempt to backport the fix before that hash will require a complete rewrite.
Last activity 3 Nov 2026. Patch Forecast updates every hour.