LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50859: cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message Commit d5c7076b772a ("smb3: add smb3.1.1 to default dialect list") extend the dialects from 3 to 4, but forget to decrease the extended length when specific the dialect, then the message length is larger than expected. This maybe leak some info through network because not initialize the message body. After apply this patch, the VALIDATE_NEGOTIATE_INFO message length is reduced from 28 bytes to 26 bytes.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-50859 is a Linux kernel CIFS/SMB client bug where a negotiation validation message can be two bytes longer than intended. The CVE says this may leak uninitialized information over the network. Business urgency is mainly for Linux systems that mount SMB/CIFS shares, especially where network exposure or sensitive workloads increase the impact of small information leaks.

Executive priority

Treat as a routine-to-prioritized kernel patching item where Linux hosts use SMB/CIFS. It is not currently evidenced as exploited, but it involves possible network information disclosure. Prioritize internet-adjacent, cross-zone, or sensitive-data systems using CIFS mounts.

Technical view

The Linux kernel CIFS code incorrectly sizes a VALIDATE_NEGOTIATE_INFO message after SMB 3.1.1 was added to the default dialect list. The message length was 28 bytes instead of 26 bytes, potentially including uninitialized message body data. Kernel stable commits are listed as fixes. No CVSS, CWE, or detailed exploitability assessment is provided in the source bundle.

Likely exposure

Exposure is most likely on affected Linux kernel versions using CIFS/SMB3 client functionality to connect to SMB servers. Systems not using CIFS mounts are less likely to encounter the vulnerable path. Exact distribution package impact depends on vendor backports and should be verified against installed kernel builds.

Exploitation context

The provided sources describe a possible network information leak, not code execution or privilege escalation. CISA KEV status is false, and the provided sources do not state active exploitation or provide public exploit evidence. Practical risk depends on CIFS usage, network position, and what uninitialized bytes could contain.

Researcher notes

The vulnerability is tied to commit d5c7076b772a adding SMB 3.1.1 to the default dialect list without adjusting extended length. The fix reduces VALIDATE_NEGOTIATE_INFO length from 28 to 26 bytes. Source evidence is limited to kernel/CVE records and stable commits; no CVSS vector is provided.

Mitigation direction

  • Update to a Linux kernel containing the referenced stable fix commits.
  • Use distribution security advisories to identify fixed kernel packages.
  • Prioritize systems that mount SMB/CIFS shares across less-trusted networks.
  • If immediate patching is unavailable, review vendor guidance for temporary risk reduction.

Validation and detection

  • Inventory Linux kernel versions across servers and endpoints.
  • Identify systems using CIFS/SMB mounts or SMB3 client workflows.
  • Confirm whether the running kernel includes a referenced stable fix or vendor backport.
  • Check vendor advisories for distribution-specific affected and fixed package versions.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50859 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
7Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxd5c7076b772ad7dcdb92303397b36aee8fa0d25d, d5c7076b772ad7dcdb92303397b36aee8fa0d25d, d5c7076b772ad7dcdb92303397b36aee8fa0d25d, d5c7076b772ad7dcdb92303397b36aee8fa0d25d, d5c7076b772ad7dcdb92303397b36aee8fa0d25d, d5c7076b772ad7dcdb92303397b36aee8fa0d25dunaffected
LinuxLinux5.0, 0, 5.4.220, 5.10.150, 5.15.75, 5.19.17, 6.0.3, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.