LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50865: tcp: fix a signed-integer-overflow bug in tcp_add_backlog()

In the Linux kernel, the following vulnerability has been resolved: tcp: fix a signed-integer-overflow bug in tcp_add_backlog() The type of sk_rcvbuf and sk_sndbuf in struct sock is int, and in tcp_add_backlog(), the variable limit is caculated by adding sk_rcvbuf, sk_sndbuf and 64 * 1024, it may exceed the max value of int and overflow. This patch reduces the limit budget by halving the sndbuf to solve this issue since ACK packets are much smaller than the payload.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2022-50865 is a Linux kernel TCP bug where a buffering calculation can overflow when socket buffer values are large. The sources do not provide CVSS, proven impact, or active exploitation evidence, so business urgency should be based on affected Linux exposure and vendor patch availability.

Executive priority

Treat as a patch-management item for Linux fleets, not an emergency based on current evidence. Increase priority for exposed infrastructure until vendor fixed status is confirmed.

Technical view

In tcp_add_backlog(), sk_rcvbuf and sk_sndbuf are int values. Adding them with 64 KiB can exceed int range and overflow the computed limit. The kernel fix reduces the limit budget by using half of sndbuf, noting ACK packets are smaller than payload.

Likely exposure

Systems running affected Linux kernel versions or downstream kernels carrying the vulnerable TCP code may be exposed. The bundle lists Linux as affected across versions including 4.9, 5.4.278, 5.10.153, 5.15.77, 6.0.7, and 6.1, but distro backport status must be verified.

Exploitation context

The source bundle does not cite KEV listing, public exploitation, exploit code, or exploitation prerequisites. It only documents the resolved signed-integer-overflow condition in the Linux TCP backlog calculation.

Researcher notes

The bundle lacks CVSS, CWE, and impact details beyond signed integer overflow. Avoid assuming remote code execution, denial of service, or exploitability without additional vendor or kernel maintainer evidence.

Mitigation direction

  • Check the running kernel version and vendor package advisory status.
  • Upgrade to a vendor-supported kernel containing the referenced stable fixes.
  • Prioritize internet-facing or high-network-throughput Linux systems for review.
  • Use distribution guidance where kernel fixes are backported without changing upstream version numbers.

Validation and detection

  • Inventory Linux hosts and record running kernel release strings.
  • Compare kernels against vendor advisories and the referenced stable commits.
  • Confirm patched packages are installed after rebooting into the updated kernel.
  • Track exceptions where appliances or embedded systems use fixed vendor firmware only.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50865 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
6Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc9c3321257e1b95be9b375f811fb250162af8d39, c9c3321257e1b95be9b375f811fb250162af8d39, c9c3321257e1b95be9b375f811fb250162af8d39, c9c3321257e1b95be9b375f811fb250162af8d39, c9c3321257e1b95be9b375f811fb250162af8d39unaffected
LinuxLinux4.9, 0, 5.4.278, 5.10.153, 5.15.77, 6.0.7, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.