Security readout for executives and security teams
Plain-English summary
CVE-2022-50351 is a Linux kernel CIFS client resource leak. If CIFS is already shut down, cifs_create() can return without freeing an xid, which may exhaust resources and affect availability. The record rates impact as local, low-complexity, low-privilege, with no confidentiality or integrity impact.
Executive priority
Treat this as a moderate availability risk, not a data breach indicator. Patch through normal kernel maintenance, with higher urgency for shared Linux servers using CIFS mounts and hosting untrusted local workloads.
Technical view
The flaw is CWE-401 in Linux kernel CIFS cifs_create(). A missing xid free on an early shutdown return path can leak xids. CVSS 3.1 is 5.5, vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. Stable kernel commits are referenced as the resolution.
Likely exposure
Exposure is most relevant to Linux systems using the CIFS/SMB client, especially where local users or workloads can trigger file creation on CIFS mounts. Exact exposure depends on kernel version, distribution backports, and whether the cited stable fixes are included.
Exploitation context
The source bundle does not show active exploitation, and KEV is false. The CVSS vector indicates local access with low privileges is required, no user interaction is needed, and the expected impact is availability loss rather than data disclosure or tampering.
Researcher notes
Evidence is limited to the CVE description, CVSS data, affected Linux entries, KEV status, and stable kernel commit references. The bundle does not include a vendor advisory narrative, exploit report, or detailed affected-version range mapping by distribution.
Mitigation direction
- Apply vendor-supported kernel updates that include the cited CIFS xid leak fix.
- Check Linux distribution advisories for backported fixes and affected package versions.
- Prioritize systems that use CIFS mounts with untrusted local users or workloads.
- If patching is delayed, reduce CIFS client use where operationally feasible.
Validation and detection
- Inventory Linux hosts and kernel package versions across affected environments.
- Identify systems with CIFS/SMB client mounts or related workloads.
- Compare installed kernels against vendor advisories and the cited stable commits.
- Confirm patched systems run an updated kernel after reboot.
- Review availability monitoring for symptoms on CIFS-heavy systems.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-50351 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/593d877c39aa9f3fe1a4b5b022492886d7d700ecCVE reference, Linux
- https://git.kernel.org/stable/c/92aa09c86ef297976a3c27c6574c0839418dc2c4CVE reference, Linux
- https://git.kernel.org/stable/c/fee0fb1f15054bb6a0ede452acb42da5bef4d587CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.