CVE-2022-50717
published 2025-12-24CVE-2022-50717: In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: add bounds check on Transfer Tag ttag is used as an index to get cmd in…
PriorityP349critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.82%
56.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: add bounds check on Transfer Tag
ttag is used as an index to get cmd in nvmet_tcp_handle_h2c_data_pdu(),
add a bounds check to avoid out-of-bounds access.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.3-1 (bookworm) | linux 6.0.3-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < 0d150ccd55dbfad36f55855b40b381884c98456e | 0d150ccd55dbfad36f55855b40b381884c98456e |
| linux | linux | >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < d5bb45f47b37d10f010355686b28c9ebacb361d4 | d5bb45f47b37d10f010355686b28c9ebacb361d4 |
| linux | linux | >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < ec8adf767e1cfa7031f853b8c71ba1963f07df15 | ec8adf767e1cfa7031f853b8c71ba1963f07df15 |
| linux | linux | >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < fcf82e4553db911d10234ff2390cfd0e2aa854e4 | fcf82e4553db911d10234ff2390cfd0e2aa854e4 |
| linux | linux | >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < 752593d04637ebdc87fd29cba81897f21ae053f0 | 752593d04637ebdc87fd29cba81897f21ae053f0 |
| linux | linux | >= 872d26a391da92ed8f0c0f5cb5fef428067b7f30 < b6a545ffa2c192b1e6da4a7924edac5ba9f4ea2b | b6a545ffa2c192b1e6da4a7924edac5ba9f4ea2b |
| linux | linux_kernel | >= 0 < 5.10.158-1 | 5.10.158-1 |
| linux | linux_kernel | >= 0 < 6.0.3-1 | 6.0.3-1 |
| linux | linux_kernel | >= 0 < 6.0.3-1 | 6.0.3-1 |
| linux | linux_kernel | >= 0 < 6.0.3-1 | 6.0.3-1 |
| linux | linux_kernel | >= 5.0.0 < 5.4.220 | 5.4.220 |
| linux | linux_kernel | >= 5.11.0 < 5.15.75 | 5.15.75 |
| linux | linux_kernel | >= 5.16.0 < 5.19.17 | 5.19.17 |
| linux | linux_kernel | >= 5.20.0 < 6.0.3 | 6.0.3 |
| linux | linux_kernel | >= 5.5.0 < 5.10.150 | 5.10.150 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: nvmet-tcp: add bounds check on Transfer Tag
vendor_redhat·2025-12-24·CVSS 6.1
CVE-2022-50717 [MEDIUM] CWE-1285 kernel: nvmet-tcp: add bounds check on Transfer Tag
kernel: nvmet-tcp: add bounds check on Transfer Tag
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: add bounds check on Transfer Tag
ttag is used as an index to get cmd in nvmet_tcp_handle_h2c_data_pdu(),
add a bounds check to avoid out-of-bounds access.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Fix deferred
Package: kernel-rt (Red Hat Enterprise Linux 9) - Fix deferred
Debian
CVE-2022-50717: linux - In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: ...
vendor_debian·2022
CVE-2022-50717 CVE-2022-50717: linux - In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: ...
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: add bounds check on Transfer Tag ttag is used as an index to get cmd in nvmet_tcp_handle_h2c_data_pdu(), add a bounds check to avoid out-of-bounds access.
Scope: local
bookworm: resolved (fixed in 6.0.3-1)
bullseye: resolved (fixed in 5.10.158-1)
forky: resolved (fixed in 6.0.3-1)
sid: resolved (fixed in 6.0.3-1)
trixie: resolved (fixed in 6.0.3-1)
OSV
nvmet-tcp: add bounds check on Transfer Tag
osv·2025-12-24
CVE-2022-50717 nvmet-tcp: add bounds check on Transfer Tag
nvmet-tcp: add bounds check on Transfer Tag
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: add bounds check on Transfer Tag
ttag is used as an index to get cmd in nvmet_tcp_handle_h2c_data_pdu(),
add a bounds check to avoid out-of-bounds access.
OSV
CVE-2022-50717: In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: add bounds check on Transfer Tag ttag is used as an index to get cmd in
osv·2025-12-24
CVE-2022-50717 CVE-2022-50717: In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: add bounds check on Transfer Tag ttag is used as an index to get cmd in
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: add bounds check on Transfer Tag ttag is used as an index to get cmd in nvmet_tcp_handle_h2c_data_pdu(), add a bounds check to avoid out-of-bounds access.
GHSA
GHSA-87xx-4gg4-q2mp: In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: add bounds check on Transfer Tag
ttag is used as an index to get cmd
ghsa_unreviewed·2025-12-24
CVE-2022-50717 GHSA-87xx-4gg4-q2mp: In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: add bounds check on Transfer Tag
ttag is used as an index to get cmd
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: add bounds check on Transfer Tag
ttag is used as an index to get cmd in nvmet_tcp_handle_h2c_data_pdu(),
add a bounds check to avoid out-of-bounds access.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2022-50717 kernel: nvmet-tcp: add bounds check on Transfer Tag
bugzilla·2025-12-24
CVE-2022-50717 [MEDIUM] CVE-2022-50717 kernel: nvmet-tcp: add bounds check on Transfer Tag
CVE-2022-50717 kernel: nvmet-tcp: add bounds check on Transfer Tag
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: add bounds check on Transfer Tag
ttag is used as an index to get cmd in nvmet_tcp_handle_h2c_data_pdu(),
add a bounds check to avoid out-of-bounds access.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025122416-CVE-2022-50717-dc68@gregkh/T
Wiz
CVE-2022-50717 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2022-50717 CVE-2022-50717 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2022-50717 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: add bounds check on Transfer Tag
ttag is used as an index to get cmd in nvmet_tcp_handle_h2c_data_pdu(),
add a bounds check to avoid out-of-bounds access.
Source : NVD
Published December 24, 2025
CNA Score N/A
Affected Technologies
Linux Kernel
Linux Debian
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 10.8
Exploitation Probability (EPSS) N/A
Affected packages and libraries
kernel-rt-64k-modules
kernel-zfcpdump-modules
Sources
NVD
Debian 11, 12, 13, 14 Has Fix Added at: Dec 26, 2025
Echo Has Fix Added at: Dec 26, 2025
Red Hat 8 S
https://git.kernel.org/stable/c/0d150ccd55dbfad36f55855b40b381884c98456ehttps://git.kernel.org/stable/c/752593d04637ebdc87fd29cba81897f21ae053f0https://git.kernel.org/stable/c/b6a545ffa2c192b1e6da4a7924edac5ba9f4ea2bhttps://git.kernel.org/stable/c/d5bb45f47b37d10f010355686b28c9ebacb361d4https://git.kernel.org/stable/c/ec8adf767e1cfa7031f853b8c71ba1963f07df15https://git.kernel.org/stable/c/fcf82e4553db911d10234ff2390cfd0e2aa854e4
2025-12-24
Published