CVE-2022-50405
published 2025-09-18CVE-2022-50405: In the Linux kernel, the following vulnerability has been resolved: net/tunnel: wait until all sk_user_data reader finish before releasing the sock There is a…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.16%
5.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
net/tunnel: wait until all sk_user_data reader finish before releasing the sock
There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.
#0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
#1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
#2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
#3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
#4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
#5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
#6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62
[exception RIP: vxlan_ecn_decapsulate+0x3b]
RIP: ffffffffc1014e7b RSP: ffffa25ec6978cb0 RFLAGS: 00010246
RAX: 0000000000000008 RBX: ffff8aa000888000 RCX: 0000000000000000
RDX: 000000000000000e RSI: ffff8a9fc7ab803e RDI: ffff8a9fd1168700
RBP: ffff8a9fc7ab803e R8: 0000000000700000 R9: 00000000000010ae
R10: ffff8a9fcb748980 R11: 0000000000000000 R12: ffff8a9fd1168700
R13: ffff8aa000888000 R14: 00000000002a0000 R15: 00000000000010ae
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
#7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan]
#8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507
#9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45
#10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807
#11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951
#12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde
#13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b
#14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139
#15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a
#16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3
#17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.4-1 (bookworm) | linux 6.1.4-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 6a93cc9052748c6355ec9d5b6c38b77f85f1cb0d < e8316584b0a6c61c9c407631040c22712b26e38c | e8316584b0a6c61c9c407631040c22712b26e38c |
| linux | linux | >= 6a93cc9052748c6355ec9d5b6c38b77f85f1cb0d < 84e566d157cc22ad2da8bdd970495855fbf13d92 | 84e566d157cc22ad2da8bdd970495855fbf13d92 |
| linux | linux | >= 6a93cc9052748c6355ec9d5b6c38b77f85f1cb0d < be34e79e0ae6adbf6e7e75ddaee9ad84795ab933 | be34e79e0ae6adbf6e7e75ddaee9ad84795ab933 |
| linux | linux | >= 6a93cc9052748c6355ec9d5b6c38b77f85f1cb0d < 303000c793f705d07b551eb7c1c27001c5b33c8d | 303000c793f705d07b551eb7c1c27001c5b33c8d |
| linux | linux | >= 6a93cc9052748c6355ec9d5b6c38b77f85f1cb0d < 91f09a776ae335ca836ed864b8f2a9461882a280 | 91f09a776ae335ca836ed864b8f2a9461882a280 |
| linux | linux | >= 6a93cc9052748c6355ec9d5b6c38b77f85f1cb0d < 9a6544343bba7da929d6d4a2dc44ec0f15970081 | 9a6544343bba7da929d6d4a2dc44ec0f15970081 |
| linux | linux | >= 6a93cc9052748c6355ec9d5b6c38b77f85f1cb0d < b38aa7465411795e9e744b8d94633910497fec2a | b38aa7465411795e9e744b8d94633910497fec2a |
| linux | linux | >= 6a93cc9052748c6355ec9d5b6c38b77f85f1cb0d < 588d0b8462f5ffed3e677e65639825b2678117ab | 588d0b8462f5ffed3e677e65639825b2678117ab |
| linux | linux | >= 6a93cc9052748c6355ec9d5b6c38b77f85f1cb0d < 3cf7203ca620682165706f70a1b12b5194607dce | 3cf7203ca620682165706f70a1b12b5194607dce |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 3.18 < 4.9.337 | 4.9.337 |
| linux | linux_kernel | >= 4.10 < 4.14.303 | 4.14.303 |
| linux | linux_kernel | >= 4.15 < 4.19.270 | 4.19.270 |
| linux | linux_kernel | >= 4.20 < 5.4.229 | 5.4.229 |
| linux | linux_kernel | >= 5.11 < 5.15.86 | 5.15.86 |
| linux | linux_kernel | >= 5.16 < 6.0.16 | 6.0.16 |
| linux | linux_kernel | >= 5.5 < 5.10.163 | 5.10.163 |
| linux | linux_kernel | >= 6.1 < 6.1.2 | 6.1.2 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: net/tunnel: wait until all sk_user_data reader finish before releasing the sock
vendor_redhat·2025-09-18·CVSS 5.5
CVE-2022-50405 [MEDIUM] CWE-820 kernel: net/tunnel: wait until all sk_user_data reader finish before releasing the sock
kernel: net/tunnel: wait until all sk_user_data reader finish before releasing the sock
In the Linux kernel, the following vulnerability has been resolved:
net/tunnel: wait until all sk_user_data reader finish before releasing the sock
There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.
#0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
#1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
#2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
#3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
#4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c
Debian
CVE-2022-50405: linux - In the Linux kernel, the following vulnerability has been resolved: net/tunnel:...
vendor_debian·2022·CVSS 5.5
CVE-2022-50405 [MEDIUM] CVE-2022-50405: linux - In the Linux kernel, the following vulnerability has been resolved: net/tunnel:...
In the Linux kernel, the following vulnerability has been resolved: net/tunnel: wait until all sk_user_data reader finish before releasing the sock There is a race condition in vxlan that when deleting a vxlan device during receiving packets, there is a possibility that the sock is released after getting vxlan_sock vs from sk_user_data. Then in later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got NULL pointer dereference. e.g. #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757 #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48 #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542 #6 [ffffa25ec6978c00] asm
GHSA
GHSA-c7j4-9pjm-j3r2: In the Linux kernel, the following vulnerability has been resolved:
net/tunnel: wait until all sk_user_data reader finish before releasing the sock
ghsa_unreviewed·2025-09-18
CVE-2022-50405 [MEDIUM] CWE-476 GHSA-c7j4-9pjm-j3r2: In the Linux kernel, the following vulnerability has been resolved:
net/tunnel: wait until all sk_user_data reader finish before releasing the sock
In the Linux kernel, the following vulnerability has been resolved:
net/tunnel: wait until all sk_user_data reader finish before releasing the sock
There is a race condition in vxlan that when deleting a vxlan device
during receiving packets, there is a possibility that the sock is
released after getting vxlan_sock vs from sk_user_data. Then in
later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got
NULL pointer dereference. e.g.
#0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757
#1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d
#2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48
#3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b
#4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb
#5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542
#6 [ffffa25ec6978c00]
OSV
CVE-2022-50405: In the Linux kernel, the following vulnerability has been resolved: net/tunnel: wait until all sk_user_data reader finish before releasing the sock Th
osv·2025-09-18·CVSS 5.5
CVE-2022-50405 [MEDIUM] CVE-2022-50405: In the Linux kernel, the following vulnerability has been resolved: net/tunnel: wait until all sk_user_data reader finish before releasing the sock Th
In the Linux kernel, the following vulnerability has been resolved: net/tunnel: wait until all sk_user_data reader finish before releasing the sock There is a race condition in vxlan that when deleting a vxlan device during receiving packets, there is a possibility that the sock is released after getting vxlan_sock vs from sk_user_data. Then in later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got NULL pointer dereference. e.g. #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757 #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48 #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542 #6 [ffffa25ec6978c00] asm
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/303000c793f705d07b551eb7c1c27001c5b33c8dhttps://git.kernel.org/stable/c/3cf7203ca620682165706f70a1b12b5194607dcehttps://git.kernel.org/stable/c/588d0b8462f5ffed3e677e65639825b2678117abhttps://git.kernel.org/stable/c/84e566d157cc22ad2da8bdd970495855fbf13d92https://git.kernel.org/stable/c/91f09a776ae335ca836ed864b8f2a9461882a280https://git.kernel.org/stable/c/9a6544343bba7da929d6d4a2dc44ec0f15970081https://git.kernel.org/stable/c/b38aa7465411795e9e744b8d94633910497fec2ahttps://git.kernel.org/stable/c/be34e79e0ae6adbf6e7e75ddaee9ad84795ab933https://git.kernel.org/stable/c/e8316584b0a6c61c9c407631040c22712b26e38c
2025-09-18
Published