Security readout for executives and security teams
Plain-English summary
This is a Linux kernel issue in IPv6 SIT tunneling statistics handling. Multiple CPUs can update the same network error counters at once, creating a data race. The public record does not show active exploitation, business impact, or a severity score.
Executive priority
Treat as a routine kernel maintenance item unless SIT tunneling is important in your environment. Prioritize internet-facing or network infrastructure Linux systems after confirming vendor applicability.
Technical view
The Linux kernel SIT driver updates dev->stats.tx_error concurrently because SIT tunnels use NETIF_F_LLTX, so ndo_start_xmit() is not protected by a spinlock. The report notes similar risk on receive paths. Stable fixes use DEV_STATS_INC() for safer counter updates.
Likely exposure
Exposure is most relevant to Linux systems running affected kernel versions or branches with IPv6 SIT tunneling support. Actual exposure depends on distribution backports and whether the referenced stable fixes are present.
Exploitation context
The issue was reported by syzbot/KCSAN as a data race. The source bundle does not cite public exploitation, CISA KEV listing, exploit availability, or attacker prerequisites.
Researcher notes
Evidence is limited to the CVE record and Linux stable commits. No CVSS, CWE, exploit status, or detailed impact analysis is provided. The fix addresses concurrency-safe statistics increments, not a clearly documented privilege or remote compromise path.
Mitigation direction
- Update to a vendor or distribution kernel containing the referenced stable fixes.
- Check Linux distribution advisories for backported fixes matching your deployed kernel.
- If updates are delayed, follow vendor guidance for SIT tunnel risk reduction.
Validation and detection
- Inventory Linux kernel versions across servers, appliances, and images.
- Identify systems using or loading IPv6 SIT tunneling functionality.
- Confirm whether deployed kernels include the referenced stable commits or distro backports.
- Track vendor advisories because CVSS and impact details are not provided.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50764 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/222cc04356984f3f98acfa756a69d4bed7c501acCVE reference
- https://git.kernel.org/stable/c/4eed93bb3e57b8cc78d17166a14e40a73276015aCVE reference
- https://git.kernel.org/stable/c/207501a986831174df09a36a8cb62a28f92f0dc8CVE reference
- https://git.kernel.org/stable/c/cb34b7cf17ecf33499c9298943f85af247abc1e9CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.