# CVE-2022-50650: linux: In the Linux kernel, the following vulnerability has been resolved:  bpf: Fix reference state management for synchron...

CVE-2022-50650 is fixed in 63 products on 1 platform, first by RHSA-2023:6583, released November 7, 2023. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2022-50650
- Priority: High
- CVSS: 7.8 (high)
- EPSS: 0.0016
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Nov 7, 2023

## Description

In the Linux kernel, the following vulnerability has been resolved:  bpf: Fix reference state management for synchronous callbacks  Currently, verifier verifies callback functions (sync and async) as if they will be executed once, (i.e. it explores execution state as if the function was being called once). The next insn to explore is set to start of subprog and the exit from nested frame is handled using curframe > 0 and prepare_func_exit. In case of async callback it uses a customized variant of push_stack simulating a kind of branch to set up custom state and execution context for the async callback.  While this approach is simple and works when callback really will be executed only once, it is unsafe for all of our current helpers which are for_each style, i.e. they execute the callback multiple times.  A callback releasing acquired references of the caller may do so multiple times, but currently verifier sees it as one call inside the frame, which then returns to caller. Hence, it thinks it released some reference that the cb e.g. got access through callback_ctx (register filled inside cb from spilled typed register on stack).  Similarly, it may see that an acquire call is unpaired inside the callback, so the caller will copy the reference state of callback and then will have to release the register with new ref_obj_ids. But again, the callback may execute multiple times, but the verifier will only account for acquired references for a single symbolic execution of the callback, which will cause leaks.  Note that for async callback case, things are different. While currently we have bpf_timer_set_callback which only executes it once, even for multiple executions it would be safe, as reference state is NULL and check_reference_leak would force program to release state before BPF_EXIT. The state is also unaffected by analysis for the caller frame. Hence async callback is safe.  Since we want the reference state to be accessible, e.g. for pointers loaded from stack through callback_ctx's PTR_TO_STACK, we still have to copy caller's reference_state to callback's bpf_func_state, but we enforce that whatever references it adds to that reference_state has been released before it hits BPF_EXIT. This requires introducing a new callback_ref member in the reference state to distinguish between caller vs callee references. Hence, check_reference_leak now errors out if it sees we are in callback_fn and we have not released callback_ref refs. Since there can be multiple nested callbacks, like frame 0 -> cb1 -> cb2 etc. we need to also distinguish between whether this particular ref belongs to this callback frame or parent, and only error for our own, so we store state->frameno (which is always non-zero for callbacks).  In short, callbacks can read parent reference_state, but cannot mutate it, to be able to use pointers acquired by the caller. They must only undo their changes (by releasing their own acquired_refs before BPF_EXIT) on top of caller reference_state before returning (at which point the caller and callback state will match anyway, so no need to copy it back to caller).

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | bpftool RHEL 9 | 0:7.2.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-64k RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-64k-core RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-64k-debug RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-64k-debug-core RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-64k-debug-devel RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-64k-debug-devel-matched RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-64k-debug-modules RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-64k-debug-modules-core RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-64k-debug-modules-extra RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-64k-devel RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-64k-devel-matched RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-64k-modules RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-64k-modules-core RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-64k-modules-extra RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-abi-stablelists RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-core RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-debug RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-debug-core RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-debug-devel RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-debug-devel-matched RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-debug-modules RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-debug-modules-core RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-debug-modules-extra RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-debug-uki-virt RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-devel RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-devel-matched RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-doc RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-modules RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-modules-core RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-modules-extra RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-rt RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-rt-core RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-rt-debug RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-rt-debug-core RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-rt-debug-devel RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-rt-debug-kvm RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-rt-debug-modules RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-rt-debug-modules-core RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-rt-debug-modules-extra RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-rt-devel RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-rt-kvm RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-rt-modules RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-rt-modules-core RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-rt-modules-extra RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-tools RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-tools-libs RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-tools-libs-devel RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-uki-virt RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-zfcpdump RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-zfcpdump-core RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-zfcpdump-devel RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-zfcpdump-devel-matched RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-zfcpdump-modules RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-zfcpdump-modules-core RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | kernel-zfcpdump-modules-extra RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | libperf RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | linux Debian 12.15 (bookworm) | 6.0.3-1 | [DEBIAN-CVE-2022-50650](https://patchblox.com/security/data/fix/linux/debian-cve-2022-50650.md) | Dec 9, 2025 |
| Linux | linux Debian 13.5 (trixie) | 6.0.3-1 | [DEBIAN-CVE-2022-50650](https://patchblox.com/security/data/fix/linux/debian-cve-2022-50650.md) | Dec 9, 2025 |
| Linux | linux Debian 14 | 6.0.3-1 | [DEBIAN-CVE-2022-50650](https://patchblox.com/security/data/fix/linux/debian-cve-2022-50650.md) | Dec 9, 2025 |
| Linux | perf RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | python3-perf RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | rtla RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |
| Linux | rv RHEL 9 | 0:5.14.0-362.8.1.el9_3 | [RHSA-2023:6583](https://patchblox.com/security/data/fix/linux/rhsa-2023-6583.md) | Nov 7, 2023 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.