Security readout for executives and security teams
Plain-English summary
CVE-2022-50855 is a Linux kernel bug in BPF LSM program attachment to cgroups. A failed attach path can leave a program reference alive longer than intended. Public sources do not provide CVSS, confirmed exploitation, or a clear business impact beyond the kernel lifecycle/resource leak described.
Executive priority
Treat as a kernel maintenance priority, not an emergency based on current evidence. Patch during the next appropriate Linux kernel update cycle, prioritizing multi-tenant, container-hosting, and systems exposing advanced BPF functionality.
Technical view
The bug is in Linux kernel BPF code added for attaching LSM programs to cgroups. Validation can return too early when the program is not meant for BPF_LSM_CGROUP, skipping bpf_prog_put and leaking the program reference count. Stable kernel commits are referenced as fixes.
Likely exposure
Exposure appears limited to Linux systems running affected kernel versions with BPF LSM/cgroup attachment capability. The source lists Linux 6.0, 6.0.16, 6.1.2, and 6.2 as affected, but version interpretation should be verified against distribution advisories.
Exploitation context
No cited source states active exploitation, public weaponization, or KEV listing. Exploitation context is incomplete. The described issue requires reaching a failed BPF LSM cgroup attach path, which generally implies local kernel BPF interaction privileges or capabilities.
Researcher notes
The public record describes a refcount leak after failed BPF LSM cgroup attach validation. Impact beyond object lifetime/resource retention is not documented in the provided sources. Confirm affected ranges and backports through kernel stable history and downstream vendor advisories.
Mitigation direction
- Update to a vendor kernel that includes the referenced stable fixes.
- Track distribution advisories for exact affected and fixed kernel builds.
- Prioritize systems allowing BPF LSM and cgroup program attachment.
- If no fixed package exists, follow vendor guidance for interim risk reduction.
Validation and detection
- Inventory Linux kernel versions across servers, containers hosts, and appliances.
- Check whether installed kernels include the referenced stable commits.
- Review whether BPF LSM and cgroup attachment features are enabled or used.
- Monitor CVE and vendor pages for severity, exploit, or fix updates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50855 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.