Security readout for executives and security teams
Plain-English summary
A Linux kernel FCoE cleanup flaw can leave a freed transport object registered after initialization failure. A local privileged user able to load or reinsert the relevant module could trigger a kernel panic, causing service outage. It is not a remote data theft issue based on the supplied CVSS.
Executive priority
Treat as a moderate availability risk. Patch during normal kernel maintenance, with higher priority for systems using FCoE or shared multi-user hosts where local users can influence kernel module loading.
Technical view
fcoe_init() attaches fcoe_sw_transport, but on fcoe_if_init() failure did not detach it, leaving freed fcoe_sw_transport on fcoe_transports list. Reinserting the module can fault in fcoe_transport_attach(), producing kernel panic. CVSS: local, low complexity, low privileges, no user interaction, high availability impact.
Likely exposure
Likely exposure is Linux systems on affected kernel versions with FCoE/libfcoe support present and module loading available. Systems not using Fibre Channel over Ethernet may still carry the code, but operational priority is lower unless the module can be loaded or storage operations rely on it.
Exploitation context
The bundle marks KEV false and provides no cited evidence of active exploitation. The attack context is local, not network-based, and requires low privileges according to CVSS. The demonstrated impact is a kernel panic during module reinsertion after an initialization failure path.
Researcher notes
The vulnerability is a cleanup imbalance in the fcoe_if_init() failure path, causing a stale freed transport pointer to remain registered. Evidence in the bundle supports denial of service through kernel panic, not confidentiality or integrity compromise. Affected-version data is kernel-centric and may differ in vendor backports.
Mitigation direction
- Update to a Linux kernel release containing the referenced stable fixes.
- Prioritize hosts using FCoE or allowing local module loading.
- Restrict untrusted local access and module-loading capability where feasible.
- Check distribution vendor advisories for packaged kernel backports.
- Schedule maintenance windows for storage-sensitive systems before kernel updates.
Validation and detection
- Inventory running kernel versions against affected versions and fixed vendor packages.
- Identify whether FCoE/libfcoe modules are present, loaded, or loadable.
- Review kernel logs for FCoE initialization failures or module reinsertion panics.
- Confirm fixed commits or vendor backports are included after update.
- Validate storage services after patching systems that use FCoE.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit d581303d6f8d
- Linux stable commit b5cc59470df6
- Linux stable commit cf74d1197c0e
- Linux stable commit be5f1a82ad60
- Linux stable commit 22e8c7a56bb1
- Linux stable commit 09a60f908d8b
- Linux stable commit 1dc499c615aa
- Linux stable commit aef82d16be5a
- Linux stable commit 4155658cee39
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50414 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d581303d6f8d4139513105d73dd65f26c6707160CVE reference
- https://git.kernel.org/stable/c/b5cc59470df64f26ad397dbb71cbf130cf489edfCVE reference
- https://git.kernel.org/stable/c/cf74d1197c0e3d2f353faa333e9e2847c73713f1CVE reference
- https://git.kernel.org/stable/c/be5f1a82ad6056db22c86005dc4cac22a20deeefCVE reference
- https://git.kernel.org/stable/c/22e8c7a56bb1cd2ed0beaaccb34282ac9cbbe27eCVE reference
- https://git.kernel.org/stable/c/09a60f908d8b6497f618113b7c3c31267dc90911CVE reference
- https://git.kernel.org/stable/c/1dc499c615aa87dc46a3f2d1f91d2d358e55f3e3CVE reference
- https://git.kernel.org/stable/c/aef82d16be5a353d913163f26fc4385e296be2b8CVE reference
- https://git.kernel.org/stable/c/4155658cee394b22b24c6d64e49247bf26d95b92CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.