CVE-2022-50168: bpf, x86: fix freeing of not-finalized bpf_prog_pack
In the Linux kernel, the following vulnerability has been resolved:
bpf, x86: fix freeing of not-finalized bpf_prog_pack
syzbot reported a few issues with bpf_prog_pack [1], [2]. This only happens
with multiple subprogs. In jit_subprogs(), we first call bpf_int_jit_compile()
on each sub program. And then, we call it on each sub program again. jit_data
is not freed in the first call of bpf_int_jit_compile(). Similarly we don't
call bpf_jit_binary_pack_finalize() in the first call of bpf_int_jit_compile().
If bpf_int_jit_compile() failed for one sub program, we will call
bpf_jit_binary_pack_finalize() for this sub program. However, we don't have a
chance to call it for other sub programs. Then we will hit "goto out_free" in
jit_subprogs(), and call bpf_jit_free on some subprograms that haven't got
bpf_jit_binary_pack_finalize() yet.
At this point, bpf_jit_binary_pack_free() is called and the whole 2MB page is
freed erroneously.
Fix this with a custom bpf_jit_free() for x86_64, which calls
bpf_jit_binary_pack_finalize() if necessary. Also, with custom
bpf_jit_free(), bpf_prog_aux->use_bpf_prog_pack is not needed any more,
remove it.
[1] https://syzkaller.appspot.com/bug?extid=2f649ec6d2eea1495a8f
[2] https://syzkaller.appspot.com/bug?extid=87f65c75f4a72db05445
Security readout for executives and security teams
Plain-English summary
This is a Linux kernel BPF JIT memory-management flaw on x86. Under error conditions with BPF programs containing multiple subprograms, the kernel could wrongly free a 2MB program-pack page. Sources show kernel fixes, but no CVSS score or active exploitation signal, so urgency depends on whether affected kernels are in use.
Executive priority
Track and remediate through the normal kernel patch program, with higher priority for shared compute, developer platforms, and systems exposing BPF functionality. Current sources do not justify emergency treatment without local exposure evidence.
Technical view
The flaw is in x86 BPF JIT handling of bpf_prog_pack during jit_subprogs() failure paths. Some subprograms may reach bpf_jit_free() before bpf_jit_binary_pack_finalize(), causing bpf_jit_binary_pack_free() to free the whole pack page erroneously. The fix adds x86_64-specific cleanup that finalizes when needed.
Likely exposure
Exposure is limited to Linux systems running affected kernel versions with x86 BPF JIT code paths. The bundle identifies Linux kernel 5.18-era affected data and stable kernel fixes, but does not provide a complete distribution-level package matrix.
Exploitation context
The source ties discovery to syzbot reports. No source in the bundle states active exploitation, and KEV is false. Treat this as a kernel stability and potential security concern until vendor advisories clarify impact for your distribution.
Researcher notes
Evidence supports a specific x86 BPF JIT cleanup bug and upstream stable fixes. Missing data includes CVSS, CWE, distribution package mapping, and confirmed exploitability beyond syzbot-triggered faults. Avoid assuming privilege escalation or remote reachability from the bundle alone.
Mitigation direction
Check Linux vendor advisories for CVE-2022-50168 and relevant kernel packages.
Upgrade to a kernel containing the referenced stable fixes.
Prioritize systems allowing untrusted or delegated BPF usage.
Apply normal kernel update testing before production rollout.
If updates are unavailable, review vendor-recommended BPF restrictions.
Validation and detection
Inventory Linux kernel versions across servers, containers hosts, and appliances.
Confirm whether deployed kernels include the referenced stable commits.
Check distribution changelogs for CVE-2022-50168 backports.
Identify systems where BPF use is exposed to non-administrative users.
Document exceptions where vendor fix status is not yet clear.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2022-50168 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
4Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Jun 18, 2025, 11:03 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.