CVE-2022-50838
published 2025-12-30CVE-2022-50838: In the Linux kernel, the following vulnerability has been resolved: net: stream: purge sk_error_queue in sk_stream_kill_queues() Changheon Lee reported TCP…
PriorityP420medium6.2
EPSS
0.25%
16.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
net: stream: purge sk_error_queue in sk_stream_kill_queues()
Changheon Lee reported TCP socket leaks, with a nice repro.
It seems we leak TCP sockets with the following sequence:
1) SOF_TIMESTAMPING_TX_ACK is enabled on the socket.
Each ACK will cook an skb put in error queue, from __skb_tstamp_tx().
__skb_tstamp_tx() is using skb_clone(), unless
SOF_TIMESTAMPING_OPT_TSONLY was also requested.
2) If the application is also using MSG_ZEROCOPY, then we put in the
error queue cloned skbs that had a struct ubuf_info attached to them.
Whenever an struct ubuf_info is allocated, sock_zerocopy_alloc()
does a sock_hold().
As long as the cloned skbs are still in sk_error_queue,
socket refcount is kept elevated.
3) Application closes the socket, while error queue is not empty.
Since tcp_close() no longer purges the socket error queue,
we might end up with a TCP socket with at least one skb in
error queue keeping the socket alive forever.
This bug can be (ab)used to consume all kernel memory
and freeze the host.
We need to purge the error queue, with proper synchronization
against concurrent writers.
Affected
33 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.4-1 (bookworm) | linux 6.1.4-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 24bcbe1cc69fa52dc4f7b5b2456678ed464724d8 < 8c330c36b3970d0917f48827fa6c7a9c75aa4602 | 8c330c36b3970d0917f48827fa6c7a9c75aa4602 |
| linux | linux | >= 24bcbe1cc69fa52dc4f7b5b2456678ed464724d8 < b458d349f8753f666233828ebd30df6f100cf7d5 | b458d349f8753f666233828ebd30df6f100cf7d5 |
| linux | linux | >= 24bcbe1cc69fa52dc4f7b5b2456678ed464724d8 < e0c8bccd40fc1c19e1d246c39bcf79e357e1ada3 | e0c8bccd40fc1c19e1d246c39bcf79e357e1ada3 |
| linux | linux | >= 3988164fe9ddf98ebf5b5cdede91ac38c5f08a7e < 9da204cd67c4fe97e8aa465d10d5c2e7076f7f42 | 9da204cd67c4fe97e8aa465d10d5c2e7076f7f42 |
| linux | linux | >= 4.14.256 < 4.14.303 | 4.14.303 |
| linux | linux | >= 4.19.218 < 4.19.270 | 4.19.270 |
| linux | linux | >= 4.4.293 < 4.5 | 4.5 |
| linux | linux | >= 4.9.291 < 4.9.337 | 4.9.337 |
| linux | linux | >= 5.10.80 < 5.10.163 | 5.10.163 |
| linux | linux | >= 5.14.19 < 5.15 | 5.15 |
| linux | linux | >= 5.15.3 < 5.15.86 | 5.15.86 |
| linux | linux | >= 5.4.160 < 5.4.229 | 5.4.229 |
| linux | linux | >= 7737b104c211fa843de268b897d601e070292a72 < c8c1eec578a9ae2dc8f14a1846942a0b7bf29d1d | c8c1eec578a9ae2dc8f14a1846942a0b7bf29d1d |
| linux | linux | >= 89be5c357de34718eaaaefed80737f432c5ab86f < bab542cf56fc174c8447c00b73be99ffd66d2d39 | bab542cf56fc174c8447c00b73be99ffd66d2d39 |
| linux | linux | >= 8b8b3d738e450d2c2ccdc75f0ab5a951746c2a96 < 6f00bd0402a1e3d2d556afba57c045bd7931e4d3 | 6f00bd0402a1e3d2d556afba57c045bd7931e4d3 |
| linux | linux | >= b631c603b5fb98d2bd709c35d384901965a3dd51 < 4f1d37ff4226eb99d6b69e9f4518e279e1a851bf | 4f1d37ff4226eb99d6b69e9f4518e279e1a851bf |
| linux | linux | >= daf15fa1fd997749e881aedd9f03f73a11240e82 < 9062493811676ee0efe6c74d98f00ca38c4e17d4 | 9062493811676ee0efe6c74d98f00ca38c4e17d4 |
| linux | linux_kernel | < 6.1.2 | 6.1.2 |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.1.1 net sk_stream_kill_queues reference count (Nessus ID 319480 / WID-SEC-2025-2941)
vuldb·2026-06-07
CVE-2022-50838 [CRITICAL] Linux Kernel up to 6.1.1 net sk_stream_kill_queues reference count (Nessus ID 319480 / WID-SEC-2025-2941)
A vulnerability labeled as critical has been found in Linux Kernel up to 6.1.1. This vulnerability affects the function sk_stream_kill_queues of the component net. The manipulation results in improper update of reference count.
This vulnerability is known as CVE-2022-50838. Access to the local network is required for this attack. No exploit is available.
The affected component should be upgraded.
GHSA
GHSA-rgwv-j5f3-fh36: In the Linux kernel, the following vulnerability has been resolved:
net: stream: purge sk_error_queue in sk_stream_kill_queues()
Changheon Lee repor
ghsa_unreviewed·2025-12-30
CVE-2022-50838 GHSA-rgwv-j5f3-fh36: In the Linux kernel, the following vulnerability has been resolved:
net: stream: purge sk_error_queue in sk_stream_kill_queues()
Changheon Lee repor
In the Linux kernel, the following vulnerability has been resolved:
net: stream: purge sk_error_queue in sk_stream_kill_queues()
Changheon Lee reported TCP socket leaks, with a nice repro.
It seems we leak TCP sockets with the following sequence:
1) SOF_TIMESTAMPING_TX_ACK is enabled on the socket.
Each ACK will cook an skb put in error queue, from __skb_tstamp_tx().
__skb_tstamp_tx() is using skb_clone(), unless
SOF_TIMESTAMPING_OPT_TSONLY was also requested.
2) If the application is also using MSG_ZEROCOPY, then we put in the
error queue cloned skbs that had a struct ubuf_info attached to them.
Whenever an struct ubuf_info is allocated, sock_zerocopy_alloc()
does a sock_hold().
As long as the cloned skbs are still in sk_error_queue,
socket refcount is kept elevated.
3) Applicati
OSV
net: stream: purge sk_error_queue in sk_stream_kill_queues()
osv·2025-12-30
CVE-2022-50838 net: stream: purge sk_error_queue in sk_stream_kill_queues()
net: stream: purge sk_error_queue in sk_stream_kill_queues()
In the Linux kernel, the following vulnerability has been resolved:
net: stream: purge sk_error_queue in sk_stream_kill_queues()
Changheon Lee reported TCP socket leaks, with a nice repro.
It seems we leak TCP sockets with the following sequence:
1) SOF_TIMESTAMPING_TX_ACK is enabled on the socket.
Each ACK will cook an skb put in error queue, from __skb_tstamp_tx().
__skb_tstamp_tx() is using skb_clone(), unless
SOF_TIMESTAMPING_OPT_TSONLY was also requested.
2) If the application is also using MSG_ZEROCOPY, then we put in the
error queue cloned skbs that had a struct ubuf_info attached to them.
Whenever an struct ubuf_info is allocated, sock_zerocopy_alloc()
does a sock_hold().
As long as the cloned skbs are still in s
OSV
CVE-2022-50838: In the Linux kernel, the following vulnerability has been resolved: net: stream: purge sk_error_queue in sk_stream_kill_queues() Changheon Lee reporte
osv·2025-12-30
CVE-2022-50838 CVE-2022-50838: In the Linux kernel, the following vulnerability has been resolved: net: stream: purge sk_error_queue in sk_stream_kill_queues() Changheon Lee reporte
In the Linux kernel, the following vulnerability has been resolved: net: stream: purge sk_error_queue in sk_stream_kill_queues() Changheon Lee reported TCP socket leaks, with a nice repro. It seems we leak TCP sockets with the following sequence: 1) SOF_TIMESTAMPING_TX_ACK is enabled on the socket. Each ACK will cook an skb put in error queue, from __skb_tstamp_tx(). __skb_tstamp_tx() is using skb_clone(), unless SOF_TIMESTAMPING_OPT_TSONLY was also requested. 2) If the application is also using MSG_ZEROCOPY, then we put in the error queue cloned skbs that had a struct ubuf_info attached to them. Whenever an struct ubuf_info is allocated, sock_zerocopy_alloc() does a sock_hold(). As long as the cloned skbs are still in sk_error_queue, socket refcount is kept elevated. 3) Application closes
Red Hat
kernel: net: stream: purge sk_error_queue in sk_stream_kill_queues()
vendor_redhat·2025-12-30·CVSS 6.2
CVE-2022-50838 [MEDIUM] CWE-401 kernel: net: stream: purge sk_error_queue in sk_stream_kill_queues()
kernel: net: stream: purge sk_error_queue in sk_stream_kill_queues()
In the Linux kernel, the following vulnerability has been resolved:
net: stream: purge sk_error_queue in sk_stream_kill_queues()
Changheon Lee reported TCP socket leaks, with a nice repro.
It seems we leak TCP sockets with the following sequence:
1) SOF_TIMESTAMPING_TX_ACK is enabled on the socket.
Each ACK will cook an skb put in error queue, from __skb_tstamp_tx().
__skb_tstamp_tx() is using skb_clone(), unless
SOF_TIMESTAMPING_OPT_TSONLY was also requested.
2) If the application is also using MSG_ZEROCOPY, then we put in the
error queue cloned skbs that had a struct ubuf_info attached to them.
Whenever an struct ubuf_info is allocated, sock_zerocopy_alloc()
does a sock_hold().
As long as the cloned skbs are still in s
Debian
CVE-2022-50838: linux - In the Linux kernel, the following vulnerability has been resolved: net: stream...
vendor_debian·2022
CVE-2022-50838 CVE-2022-50838: linux - In the Linux kernel, the following vulnerability has been resolved: net: stream...
In the Linux kernel, the following vulnerability has been resolved: net: stream: purge sk_error_queue in sk_stream_kill_queues() Changheon Lee reported TCP socket leaks, with a nice repro. It seems we leak TCP sockets with the following sequence: 1) SOF_TIMESTAMPING_TX_ACK is enabled on the socket. Each ACK will cook an skb put in error queue, from __skb_tstamp_tx(). __skb_tstamp_tx() is using skb_clone(), unless SOF_TIMESTAMPING_OPT_TSONLY was also requested. 2) If the application is also using MSG_ZEROCOPY, then we put in the error queue cloned skbs that had a struct ubuf_info attached to them. Whenever an struct ubuf_info is allocated, sock_zerocopy_alloc() does a sock_hold(). As long as the cloned skbs are still in sk_error_queue, socket refcount is kept elevated. 3) Application closes
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2022-50838 kernel: net: stream: purge sk_error_queue in sk_stream_kill_queues()
bugzilla·2025-12-30
CVE-2022-50838 [MEDIUM] CVE-2022-50838 kernel: net: stream: purge sk_error_queue in sk_stream_kill_queues()
CVE-2022-50838 kernel: net: stream: purge sk_error_queue in sk_stream_kill_queues()
In the Linux kernel, the following vulnerability has been resolved:
net: stream: purge sk_error_queue in sk_stream_kill_queues()
Changheon Lee reported TCP socket leaks, with a nice repro.
It seems we leak TCP sockets with the following sequence:
1) SOF_TIMESTAMPING_TX_ACK is enabled on the socket.
Each ACK will cook an skb put in error queue, from __skb_tstamp_tx().
__skb_tstamp_tx() is using skb_clone(), unless
SOF_TIMESTAMPING_OPT_TSONLY was also requested.
2) If the application is also using MSG_ZEROCOPY, then we put in the
error queue cloned skbs that had a struct ubuf_info attached to them.
Whenever an struct ubuf_info is allocated, sock_zerocopy_alloc()
does a sock_hold().
As long as the clo
Wiz
CVE-2022-50838 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2022-50838 CVE-2022-50838 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2022-50838 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
net: stream: purge sk_error_queue in sk_stream_kill_queues()
Changheon Lee reported TCP socket leaks, with a nice repro.
It seems we leak TCP sockets with the following sequence:
SOF_TIMESTAMPING_TX_ACK is enabled on the socket.
Each ACK will cook an skb put in error queue, from __skb_tstamp_tx().
__skb_tstamp_tx() is using skb_clone(), unless
SOF_TIMESTAMPING_OPT_TSONLY was also requested.
If the application is also using MSG_ZEROCOPY, then we put in the
error queue cloned skbs that had a struct ubuf_info attached to them.
Whenever an struct ubuf_info is allocated, sock_zerocopy_alloc()
does a sock_hold().
As long as the cloned skbs are still
https://git.kernel.org/stable/c/4f1d37ff4226eb99d6b69e9f4518e279e1a851bfhttps://git.kernel.org/stable/c/6f00bd0402a1e3d2d556afba57c045bd7931e4d3https://git.kernel.org/stable/c/8c330c36b3970d0917f48827fa6c7a9c75aa4602https://git.kernel.org/stable/c/9062493811676ee0efe6c74d98f00ca38c4e17d4https://git.kernel.org/stable/c/9da204cd67c4fe97e8aa465d10d5c2e7076f7f42https://git.kernel.org/stable/c/b458d349f8753f666233828ebd30df6f100cf7d5https://git.kernel.org/stable/c/bab542cf56fc174c8447c00b73be99ffd66d2d39https://git.kernel.org/stable/c/c8c1eec578a9ae2dc8f14a1846942a0b7bf29d1dhttps://git.kernel.org/stable/c/e0c8bccd40fc1c19e1d246c39bcf79e357e1ada3
2025-12-30
Published