# CVE-2022-50731: linux: In the Linux kernel, the following vulnerability has been resolved:  crypto: akcipher - default implementation for se...

CVE-2022-50731 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-50731, released December 24, 2025. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2022-50731
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0025
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Dec 24, 2025

## Description

In the Linux kernel, the following vulnerability has been resolved:  crypto: akcipher - default implementation for setting a private key  Changes from v1:   * removed the default implementation from set_pub_key: it is assumed that     an implementation must always have this callback defined as there are     no use case for an algorithm, which doesn't need a public key  Many akcipher implementations (like ECDSA) support only signature verifications, so they don't have all callbacks defined.  Commit 78a0324f4a53 ("crypto: akcipher - default implementations for request callbacks") introduced default callbacks for sign/verify operations, which just return an error code.  However, these are not enough, because before calling sign the caller would likely call set_priv_key first on the instantiated transform (as the in-kernel testmgr does). This function does not have a default stub, so the kernel crashes, when trying to set a private key on an akcipher, which doesn't support signature generation.  I've noticed this, when trying to add a KAT vector for ECDSA signature to the testmgr.  With this patch the testmgr returns an error in dmesg (as it should) instead of crashing the kernel NULL ptr dereference.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.0.3-1 | [DEBIAN-CVE-2022-50731](https://patchblox.com/security/data/fix/linux/debian-cve-2022-50731.md) | Dec 24, 2025 |
| Linux | linux Debian 13.5 (trixie) | 6.0.3-1 | [DEBIAN-CVE-2022-50731](https://patchblox.com/security/data/fix/linux/debian-cve-2022-50731.md) | Dec 24, 2025 |
| Linux | linux Debian 14 | 6.0.3-1 | [DEBIAN-CVE-2022-50731](https://patchblox.com/security/data/fix/linux/debian-cve-2022-50731.md) | Dec 24, 2025 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.