Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can leak memory during failed CIFS/SMB mount authentication setup. It does not expose data or alter files, but repeated triggering could reduce system availability. Exposure is most relevant on systems where local users or services can initiate CIFS mounts.
Executive priority
Schedule remediation through normal kernel patch cycles, with faster handling for shared servers or automation hosts that perform CIFS mounts. The issue is availability-focused and local, not a remote data breach indicator based on the provided evidence.
Technical view
CVE-2022-50372 is a CWE-401 memory leak in the Linux CIFS client. If building the NTLMSSP negotiate blob fails during session setup, the session setup request was not freed. CVSS is 5.5 with local attack vector, low privileges, no confidentiality or integrity impact, and high availability impact.
Likely exposure
Linux systems using CIFS/SMB mounts are the primary concern, especially where local users, jobs, or services can trigger mount.cifs operations. The source lists Linux kernel versions including 5.16, 6.0.6, and 6.1 as affected.
Exploitation context
The provided sources do not show active exploitation, and the CVE is not marked KEV. The CVSS vector indicates local access with low privileges is required. Practical impact depends on the ability to repeatedly reach the failed CIFS authentication path.
Researcher notes
The root cause is missing cleanup when NTLMSSP negotiate blob construction fails in CIFS session setup. Evidence is limited to the CVE text, CVSS, affected version metadata, and two kernel stable references. No exploit status or additional vendor-specific fixed package versions are provided.
Mitigation direction
- Update to a vendor-supported kernel containing the referenced stable fixes.
- Check distribution advisories for backported fixes for your exact kernel package.
- Restrict CIFS mount initiation to trusted users and services where operationally feasible.
- Prioritize patching hosts that automate CIFS mounts or expose mount capability to users.
Validation and detection
- Inventory Linux hosts and identify those using CIFS or SMB mounts.
- Compare running kernel packages against vendor fixed versions or referenced stable commits.
- Review logs and monitoring for repeated failed CIFS mount attempts and memory pressure.
- After patching, validate normal CIFS mount workflows in staging or maintenance windows.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-50372 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.