CVE-2022-50764Improper Synchronization in Linux

Severity
6.2MEDIUM
No vector
EPSS
0.0%
top 92.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedDec 24

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6/sit: use DEV_STATS_INC() to avoid data-races syzbot/KCSAN reported that multiple cpus are updating dev->stats.tx_error concurrently. This is because sit tunnels are NETIF_F_LLTX, meaning their ndo_start_xmit() is not protected by a spinlock. While original KCSAN report was about tx path, rx path has the same issue.

Affected Packages4 packages

Linuxlinux/linux_kernel2.6.375.15.86+2
Debianlinux/linux_kernel< 6.1.4-1+2
CVEListV5linux/linux8df40d1033d64597dcf1efd4f7547e817f7a953b222cc04356984f3f98acfa756a69d4bed7c501ac+4
debiandebian/linux< linux 6.1.4-1 (bookworm)

🔴Vulnerability Details

3
OSV
ipv6/sit: use DEV_STATS_INC() to avoid data-races2025-12-24
GHSA
GHSA-grmr-47cc-4gc2: In the Linux kernel, the following vulnerability has been resolved: ipv6/sit: use DEV_STATS_INC() to avoid data-races syzbot/KCSAN reported that mul2025-12-24
OSV
CVE-2022-50764: In the Linux kernel, the following vulnerability has been resolved: ipv6/sit: use DEV_STATS_INC() to avoid data-races syzbot/KCSAN reported that multi2025-12-24

📋Vendor Advisories

2
Red Hat
kernel: ipv6/sit: use DEV_STATS_INC() to avoid data-races2025-12-24
Debian
CVE-2022-50764: linux - In the Linux kernel, the following vulnerability has been resolved: ipv6/sit: u...2022

🕵️Threat Intelligence

1
Wiz
CVE-2022-50764 Impact, Exploitability, and Mitigation Steps | Wiz