CVE-2022-50167
published 2025-06-18CVE-2022-50167: In the Linux kernel, the following vulnerability has been resolved: bpf: fix potential 32-bit overflow when accessing ARRAY map element If BPF array map is…
PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.22%
12.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
bpf: fix potential 32-bit overflow when accessing ARRAY map element
If BPF array map is bigger than 4GB, element pointer calculation can
overflow because both index and elem_size are u32. Fix this everywhere
by forcing 64-bit multiplication. Extract this formula into separate
small helper and use it consistently in various places.
Speculative-preventing formula utilizing index_mask trick is left as is,
but explicit u64 casts are added in both places.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.19.6-1 (bookworm) | linux 5.19.6-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= c85d69135a9175c50a823d04d62d932312d037b3 < 063e092534d4c6785228e5b1eb6e9329f66ccbe4 | 063e092534d4c6785228e5b1eb6e9329f66ccbe4 |
| linux | linux | >= c85d69135a9175c50a823d04d62d932312d037b3 < 3c7256b880b3a5aa1895fd169a34aa4224a11862 | 3c7256b880b3a5aa1895fd169a34aa4224a11862 |
| linux | linux | >= c85d69135a9175c50a823d04d62d932312d037b3 < 87ac0d600943994444e24382a87aa19acc4cd3d4 | 87ac0d600943994444e24382a87aa19acc4cd3d4 |
| linux | linux_kernel | >= 0 < 5.19.6-1 | 5.19.6-1 |
| linux | linux_kernel | >= 0 < 5.19.6-1 | 5.19.6-1 |
| linux | linux_kernel | >= 0 < 5.19.6-1 | 5.19.6-1 |
| linux | linux_kernel | >= 5.19 < 5.19.2 | 5.19.2 |
| linux | linux_kernel | >= 5.3 < 5.18.18 | 5.18.18 |
| msrc | cbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.200.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.202.1-1_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: bpf: fix potential 32-bit overflow when accessing ARRAY map element
vendor_redhat·2025-06-18·CVSS 5.5
CVE-2022-50167 [MEDIUM] CWE-190 kernel: bpf: fix potential 32-bit overflow when accessing ARRAY map element
kernel: bpf: fix potential 32-bit overflow when accessing ARRAY map element
In the Linux kernel, the following vulnerability has been resolved:
bpf: fix potential 32-bit overflow when accessing ARRAY map element
If BPF array map is bigger than 4GB, element pointer calculation can
overflow because both index and elem_size are u32. Fix this everywhere
by forcing 64-bit multiplication. Extract this formula into separate
small helper and use it consistently in various places.
Speculative-preventing formula utilizing index_mask trick is left as is,
but explicit u64 casts are added in both places.
A potential 32-bit overflow flaw was found when accessing the ARRAY map element in the Linux kernel. This issue may lead to a crash.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Pac
Microsoft
bpf: fix potential 32-bit overflow when accessing ARRAY map element
vendor_msrc·2025-06-10·CVSS 5.5
CVE-2022-50167 [MEDIUM] CWE-190 bpf: fix potential 32-bit overflow when accessing ARRAY map element
bpf: fix potential 32-bit overflow when accessing ARRAY map element
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Debian
CVE-2022-50167: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: fix po...
vendor_debian·2022·CVSS 5.5
CVE-2022-50167 [MEDIUM] CVE-2022-50167: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: fix po...
In the Linux kernel, the following vulnerability has been resolved: bpf: fix potential 32-bit overflow when accessing ARRAY map element If BPF array map is bigger than 4GB, element pointer calculation can overflow because both index and elem_size are u32. Fix this everywhere by forcing 64-bit multiplication. Extract this formula into separate small helper and use it consistently in various places. Speculative-preventing formula utilizing index_mask trick is left as is, but explicit u64 casts are added in both places.
Scope: local
bookworm: resolved (fixed in 5.19.6-1)
bullseye: open
forky: resolved (fixed in 5.19.6-1)
sid: resolved (fixed in 5.19.6-1)
trixie: resolved (fixed in 5.19.6-1)
GHSA
GHSA-mrhw-xcq4-7jw7: In the Linux kernel, the following vulnerability has been resolved:
bpf: fix potential 32-bit overflow when accessing ARRAY map element
If BPF array
ghsa_unreviewed·2025-06-18
CVE-2022-50167 [MEDIUM] CWE-190 GHSA-mrhw-xcq4-7jw7: In the Linux kernel, the following vulnerability has been resolved:
bpf: fix potential 32-bit overflow when accessing ARRAY map element
If BPF array
In the Linux kernel, the following vulnerability has been resolved:
bpf: fix potential 32-bit overflow when accessing ARRAY map element
If BPF array map is bigger than 4GB, element pointer calculation can
overflow because both index and elem_size are u32. Fix this everywhere
by forcing 64-bit multiplication. Extract this formula into separate
small helper and use it consistently in various places.
Speculative-preventing formula utilizing index_mask trick is left as is,
but explicit u64 casts are added in both places.
OSV
CVE-2022-50167: In the Linux kernel, the following vulnerability has been resolved: bpf: fix potential 32-bit overflow when accessing ARRAY map element If BPF array m
osv·2025-06-18·CVSS 5.5
CVE-2022-50167 [MEDIUM] CVE-2022-50167: In the Linux kernel, the following vulnerability has been resolved: bpf: fix potential 32-bit overflow when accessing ARRAY map element If BPF array m
In the Linux kernel, the following vulnerability has been resolved: bpf: fix potential 32-bit overflow when accessing ARRAY map element If BPF array map is bigger than 4GB, element pointer calculation can overflow because both index and elem_size are u32. Fix this everywhere by forcing 64-bit multiplication. Extract this formula into separate small helper and use it consistently in various places. Speculative-preventing formula utilizing index_mask trick is left as is, but explicit u64 casts are added in both places.
No detection rules found.
No public exploits indexed.
2025-06-18
Published