Security readout for executives and security teams
Plain-English summary
CVE-2022-50405 is a Linux kernel crash risk in VXLAN tunnel handling. When a VXLAN device is deleted while packets are being received, a race condition can dereference a null pointer and crash the system. The business impact is availability, not data theft or tampering.
Executive priority
Treat this as a moderate operational resiliency issue. Patch routinely but prioritize infrastructure running VXLAN overlays, because successful triggering can crash affected systems and disrupt services.
Technical view
The flaw is a CWE-476 null pointer dereference in Linux net/tunnel VXLAN receive handling. A socket can be released while sk_user_data readers still use vxlan_sock, causing crashes in vxlan_ecn_decapsulate or vxlan_get_sk_family. CVSS is 5.5 with local, low-privilege availability impact.
Likely exposure
Exposure is most relevant on Linux systems using VXLAN or tunnel networking, including overlay networks. The source lists affected Linux kernel versions and stable commit references, but distro backport status must be confirmed with each vendor.
Exploitation context
The source bundle does not support active exploitation; KEV is false. The CVE text references a reproducer, but this assessment does not provide offensive steps. Abuse appears local and availability-focused, requiring conditions around VXLAN deletion during packet receipt.
Researcher notes
Evidence is strongest for the race condition, crash path, CVSS vector, and stable kernel fixes. The bundle does not provide distro-specific fixed versions, remote exploitability evidence, or active exploitation confirmation.
Mitigation direction
- Apply Linux vendor kernel updates that include the referenced stable fixes.
- Prioritize systems using VXLAN, overlays, or tunnel-heavy virtualization networking.
- Check distribution advisories for exact fixed package versions and backport status.
- Limit local administrative access to tunnel device management where operationally feasible.
Validation and detection
- Inventory Linux hosts and kernel versions against vendor advisories.
- Identify systems with VXLAN modules or tunnel interfaces enabled.
- Confirm installed kernels include one of the referenced stable fixes or vendor backports.
- Review crash logs for VXLAN-related null pointer dereferences during tunnel removal.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-50405 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e8316584b0a6c61c9c407631040c22712b26e38cCVE reference
- https://git.kernel.org/stable/c/84e566d157cc22ad2da8bdd970495855fbf13d92CVE reference
- https://git.kernel.org/stable/c/be34e79e0ae6adbf6e7e75ddaee9ad84795ab933CVE reference
- https://git.kernel.org/stable/c/303000c793f705d07b551eb7c1c27001c5b33c8dCVE reference
- https://git.kernel.org/stable/c/91f09a776ae335ca836ed864b8f2a9461882a280CVE reference
- https://git.kernel.org/stable/c/9a6544343bba7da929d6d4a2dc44ec0f15970081CVE reference
- https://git.kernel.org/stable/c/b38aa7465411795e9e744b8d94633910497fec2aCVE reference
- https://git.kernel.org/stable/c/588d0b8462f5ffed3e677e65639825b2678117abCVE reference
- https://git.kernel.org/stable/c/3cf7203ca620682165706f70a1b12b5194607dceCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.