LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50168: bpf, x86: fix freeing of not-finalized bpf_prog_pack

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: fix freeing of not-finalized bpf_prog_pack syzbot reported a few issues with bpf_prog_pack [1], [2]. This only happens with multiple subprogs. In jit_subprogs(), we first call bpf_int_jit_compile() on each sub program. And then, we call it on each sub program again. jit_data is not freed in the first call of bpf_int_jit_compile(). Similarly we don't call bpf_jit_binary_pack_finalize() in the first call of bpf_int_jit_compile(). If bpf_int_jit_compile() failed for one sub program, we will call bpf_jit_binary_pack_finalize() for this sub program. However, we don't have a chance to call it for other sub programs. Then we will hit "goto out_free" in jit_subprogs(), and call bpf_jit_free on some subprograms that haven't got bpf_jit_binary_pack_finalize() yet. At this point, bpf_jit_binary_pack_free() is called and the whole 2MB page is freed erroneously. Fix this with a custom bpf_jit_free() for x86_64, which calls bpf_jit_binary_pack_finalize() if necessary. Also, with custom bpf_jit_free(), bpf_prog_aux->use_bpf_prog_pack is not needed any more, remove it. [1] https://syzkaller.appspot.com/bug?extid=2f649ec6d2eea1495a8f [2] https://syzkaller.appspot.com/bug?extid=87f65c75f4a72db05445

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel BPF JIT memory-management flaw on x86. Under error conditions with BPF programs containing multiple subprograms, the kernel could wrongly free a 2MB program-pack page. Sources show kernel fixes, but no CVSS score or active exploitation signal, so urgency depends on whether affected kernels are in use.

Executive priority

Track and remediate through the normal kernel patch program, with higher priority for shared compute, developer platforms, and systems exposing BPF functionality. Current sources do not justify emergency treatment without local exposure evidence.

Technical view

The flaw is in x86 BPF JIT handling of bpf_prog_pack during jit_subprogs() failure paths. Some subprograms may reach bpf_jit_free() before bpf_jit_binary_pack_finalize(), causing bpf_jit_binary_pack_free() to free the whole pack page erroneously. The fix adds x86_64-specific cleanup that finalizes when needed.

Likely exposure

Exposure is limited to Linux systems running affected kernel versions with x86 BPF JIT code paths. The bundle identifies Linux kernel 5.18-era affected data and stable kernel fixes, but does not provide a complete distribution-level package matrix.

Exploitation context

The source ties discovery to syzbot reports. No source in the bundle states active exploitation, and KEV is false. Treat this as a kernel stability and potential security concern until vendor advisories clarify impact for your distribution.

Researcher notes

Evidence supports a specific x86 BPF JIT cleanup bug and upstream stable fixes. Missing data includes CVSS, CWE, distribution package mapping, and confirmed exploitability beyond syzbot-triggered faults. Avoid assuming privilege escalation or remote reachability from the bundle alone.

Mitigation direction

  • Check Linux vendor advisories for CVE-2022-50168 and relevant kernel packages.
  • Upgrade to a kernel containing the referenced stable fixes.
  • Prioritize systems allowing untrusted or delegated BPF usage.
  • Apply normal kernel update testing before production rollout.
  • If updates are unavailable, review vendor-recommended BPF restrictions.

Validation and detection

  • Inventory Linux kernel versions across servers, containers hosts, and appliances.
  • Confirm whether deployed kernels include the referenced stable commits.
  • Check distribution changelogs for CVE-2022-50168 backports.
  • Identify systems where BPF use is exposed to non-administrative users.
  • Document exceptions where vendor fix status is not yet clear.
Prepared
Confidence
medium
Sources
7

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50168 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1022a5498f6f745c3b5fd3f050a5e11e7ca354f0, 1022a5498f6f745c3b5fd3f050a5e11e7ca354f0, 1022a5498f6f745c3b5fd3f050a5e11e7ca354f0unaffected
LinuxLinux5.18, 0, 5.18.18, 5.19.2, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.