LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50452: net: sched: cake: fix null pointer access issue when cake_init() fails

In the Linux kernel, the following vulnerability has been resolved: net: sched: cake: fix null pointer access issue when cake_init() fails When the default qdisc is cake, if the qdisc of dev_queue fails to be inited during mqprio_init(), cake_reset() is invoked to clear resources. In this case, the tins is NULL, and it will cause gpf issue. The process is as follows: qdisc_create_dflt() cake_init() q->tins = kvcalloc(...) --->failed, q->tins is NULL ... qdisc_put() ... cake_reset() ... cake_dequeue_one() b = &q->tins[...] --->q->tins is NULL The following is the Call Trace information: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:cake_dequeue_one+0xc9/0x3c0 Call Trace: <TASK> cake_reset+0xb1/0x140 qdisc_reset+0xed/0x6f0 qdisc_destroy+0x82/0x4c0 qdisc_put+0x9e/0xb0 qdisc_create_dflt+0x2c3/0x4a0 mqprio_init+0xa71/0x1760 qdisc_create+0x3eb/0x1000 tc_modify_qdisc+0x408/0x1720 rtnetlink_rcv_msg+0x38e/0xac0 netlink_rcv_skb+0x12d/0x3a0 netlink_unicast+0x4a2/0x740 netlink_sendmsg+0x826/0xcc0 sock_sendmsg+0xc5/0x100 ____sys_sendmsg+0x583/0x690 ___sys_sendmsg+0xe8/0x160 __sys_sendmsg+0xbf/0x160 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f89e5122d04 </TASK>

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

A Linux kernel networking scheduler bug can crash the kernel when CAKE queue setup fails during certain traffic-control configuration. The business risk is service disruption on affected Linux systems, not proven data theft. The source bundle does not show active exploitation or a CVSS score.

Executive priority

Treat this as a reliability and availability issue for Linux networking hosts. Prioritize patching where affected kernels support production traffic shaping, edge networking, or systems with frequent qdisc automation.

Technical view

The CAKE qdisc reset path can dereference q->tins after cake_init() allocation failure leaves it NULL. The reported path runs through mqprio_init(), qdisc_destroy(), cake_reset(), and cake_dequeue_one(), producing a KASAN null-pointer general protection fault.

Likely exposure

Exposure is likely limited to affected Linux kernels using or configuring CAKE qdisc, especially systems where traffic-control changes are possible. Remote unauthenticated exposure is not evidenced in the supplied sources.

Exploitation context

The bundle says KEV is false and provides no public exploitation evidence. The trace suggests triggering depends on kernel traffic-control configuration and an initialization failure condition, but the sources do not fully define required privileges.

Researcher notes

The CVE text identifies a NULL q->tins dereference after kvcalloc failure in cake_init(). Missing details include CVSS, CWE, exact privilege requirements, and distribution-specific fixed package versions.

Mitigation direction

  • Check the running kernel against vendor advisories for CVE-2022-50452.
  • Apply the relevant stable kernel update containing the referenced CAKE fix.
  • Restrict traffic-control administration to trusted operators and automation.
  • Monitor vendor guidance if using custom or backported kernels.

Validation and detection

  • Inventory Linux kernel versions on systems using advanced qdisc features.
  • Review whether CAKE is configured as a default or operational qdisc.
  • Confirm vendor kernel changelogs include the referenced stable commits.
  • Look for crash logs mentioning cake_dequeue_one, cake_reset, or null-ptr-deref.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50452 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux046f6fd5daefac7f5abdafb436b30f63bc7c602b, 046f6fd5daefac7f5abdafb436b30f63bc7c602b, 046f6fd5daefac7f5abdafb436b30f63bc7c602b, 046f6fd5daefac7f5abdafb436b30f63bc7c602b, 046f6fd5daefac7f5abdafb436b30f63bc7c602b, 046f6fd5daefac7f5abdafb436b30f63bc7c602bunaffected
LinuxLinux4.19, 0, 4.19.264, 5.4.221, 5.10.152, 5.15.76, 6.0.6, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.