{
  "cveId": "CVE-2022-50310",
  "url": "https://patchblox.com/security/cve/CVE-2022-50310",
  "summary": "CVE-2022-50310 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-50310, released September 15, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  ip6mr: fix UAF issue in ip6mr_sk_done() when add...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  ip6mr: fix UAF issue in ip6mr_sk_done() when addrconf_init_net() failed  If the initialization fails in calling addrconf_init_net(), devconf_all is the pointer that has been released. Then ip6mr_sk_done() is called to release the net, accessing devconf-\u003Emc_forwarding directly causes invalid pointer access.  The process is as follows: setup_net() \tops_init() \t\taddrconf_init_net() \t\tall = kmemdup(...)           ---\u003E alloc \u0022all\u0022 \t\t... \t\tnet-\u003Eipv6.devconf_all = all; \t\t__addrconf_sysctl_register() ---\u003E failed \t\t... \t\tkfree(all);                  ---\u003E ipv6.devconf_all invalid \t\t... \tops_exit_list() \t\t... \t\tip6mr_sk_done() \t\t\tdevconf = net-\u003Eipv6.devconf_all; \t\t\t//devconf is invalid pointer \t\t\tif (!devconf || !atomic_read(\u0026devconf-\u003Emc_forwarding))  The following is the Call Trace information: BUG: KASAN: use-after-free in ip6mr_sk_done\u002B0x112/0x3a0 Read of size 4 at addr ffff888075508e88 by task ip/14554 Call Trace: \u003CTASK\u003E dump_stack_lvl\u002B0x8e/0xd1 print_report\u002B0x155/0x454 kasan_report\u002B0xba/0x1f0 kasan_check_range\u002B0x35/0x1b0 ip6mr_sk_done\u002B0x112/0x3a0 rawv6_close\u002B0x48/0x70 inet_release\u002B0x109/0x230 inet6_release\u002B0x4c/0x70 sock_release\u002B0x87/0x1b0 igmp6_net_exit\u002B0x6b/0x170 ops_exit_list\u002B0xb0/0x170 setup_net\u002B0x7ac/0xbd0 copy_net_ns\u002B0x2e6/0x6b0 create_new_namespaces\u002B0x382/0xa50 unshare_nsproxy_namespaces\u002B0xa6/0x1c0 ksys_unshare\u002B0x3a4/0x7e0 __x64_sys_unshare\u002B0x2d/0x40 do_syscall_64\u002B0x35/0x80 entry_SYSCALL_64_after_hwframe\u002B0x46/0xb0 RIP: 0033:0x7f7963322547  \u003C/TASK\u003E Allocated by task 14554: kasan_save_stack\u002B0x1e/0x40 kasan_set_track\u002B0x21/0x30 __kasan_kmalloc\u002B0xa1/0xb0 __kmalloc_node_track_caller\u002B0x4a/0xb0 kmemdup\u002B0x28/0x60 addrconf_init_net\u002B0x1be/0x840 ops_init\u002B0xa5/0x410 setup_net\u002B0x5aa/0xbd0 copy_net_ns\u002B0x2e6/0x6b0 create_new_namespaces\u002B0x382/0xa50 unshare_nsproxy_namespaces\u002B0xa6/0x1c0 ksys_unshare\u002B0x3a4/0x7e0 __x64_sys_unshare\u002B0x2d/0x40 do_syscall_64\u002B0x35/0x80 entry_SYSCALL_64_after_hwframe\u002B0x46/0xb0  Freed by task 14554: kasan_save_stack\u002B0x1e/0x40 kasan_set_track\u002B0x21/0x30 kasan_save_free_info\u002B0x2a/0x40 ____kasan_slab_free\u002B0x155/0x1b0 slab_free_freelist_hook\u002B0x11b/0x220 __kmem_cache_free\u002B0xa4/0x360 addrconf_init_net\u002B0x623/0x840 ops_init\u002B0xa5/0x410 setup_net\u002B0x5aa/0xbd0 copy_net_ns\u002B0x2e6/0x6b0 create_new_namespaces\u002B0x382/0xa50 unshare_nsproxy_namespaces\u002B0xa6/0x1c0 ksys_unshare\u002B0x3a4/0x7e0 __x64_sys_unshare\u002B0x2d/0x40 do_syscall_64\u002B0x35/0x80 entry_SYSCALL_64_after_hwframe\u002B0x46/0xb0",
  "published": "2025-09-15T15:15:42Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00157,
  "epssPercentile": 0.04849,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.0.6-1",
      "fix": "DEBIAN-CVE-2022-50310",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50310",
      "released": "2025-09-15T15:15:42Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.0.6-1",
      "fix": "DEBIAN-CVE-2022-50310",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50310",
      "released": "2025-09-15T15:15:42Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.0.6-1",
      "fix": "DEBIAN-CVE-2022-50310",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50310",
      "released": "2025-09-15T15:15:42Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}