Answer in brief
CVE-2022-50243 records a High severity (CVSS 7.8) vulnerability in sctp: handle the error returned from sctp_auth_asoc_init_active_key. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:5.14:-:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:5.14:rc3:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:5.14:rc4:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:5.14:rc5:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:5.14:rc6:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:5.14:rc7:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | 5.14 | Not reported |
| Linux/Linuxgeneric | >=50b57223da67653c61e405d0a7592355cfe4585e <b8fa99a3a11bdd77fef6b4a97f1021eb30b5ba40 || >=b60461696a0b0fdaf240bc365b7983698f88ded2 <382ff44716603a54f5fd238ddec6a2468e217612 || >=8eb225873246312660ccd68296959a7b213d0cdd <f65955340e0044f5c41ac799a01698ac7dee8a4e || >=58acd10092268831e49de279446c314727101292 <19d636b663e0e92951bba5fced929ca7fd25c552 || >=58acd10092268831e49de279446c314727101292 <0f90099d18e3abdc01babf686f41f63fe04939c1 || >=58acd10092268831e49de279446c314727101292 <3b0fcf5e29c0940e1169ce9c44f73edd98bdf12d || >=58acd10092268831e49de279446c314727101292 <022152aaebe116a25c39818a07e175a8cd3c1e11 || c1de376423a7759bf4fa25d6a038a4c1e035c9e1 || >=4.19.199 <4.19.262 || >=5.4.136 <5.4.220 || >=5.10.54 <5.10.150 || >=5.13.6 <5.14 | b8fa99a3a11bdd77fef6b4a97f1021eb30b5ba40, 382ff44716603a54f5fd238ddec6a2468e217612, f65955340e0044f5c41ac799a01698ac7dee8a4e, 19d636b663e0e92951bba5fced929ca7fd25c552, 0f90099d18e3abdc01babf686f41f63fe04939c1, 3b0fcf5e29c0940e1169ce9c44f73edd98bdf12d, 022152aaebe116a25c39818a07e175a8cd3c1e11, 4.19.262, 5.4.220, 5.10.150, 5.14 |
Published upstream
Sep 15, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 4, 2026
In the Linux kernel, the following vulnerability has been resolved: sctp: handle the error returned from sctp_auth_asoc_init_active_key When it returns an error from sctp_auth_asoc_init_active_key(), the active_key is actually not updated. The old sh_key will be freeed while it's still used as active key in asoc. Then an use-after-free will be triggered when sending patckets, as found by syzbot: sctp_auth_shkey_hold+0x22/0xa0 net/sctp/auth.c:112 sctp_set_owner_w net/sctp/socket.c:132 [inline] sctp_sendmsg_to_asoc+0xbd5/0x1a20 net/sctp/socket.c:1863 sctp_sendmsg+0x1053/0x1d50 net/sctp/socket.c:2025 inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:819 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:734 This patch is to fix it by not replacing the sh_key when it returns errors from sctp_auth_asoc_init_active_key() in sctp_auth_set_key(). For sctp_auth_set_active_key(), old active_key_id will be set back to asoc->active_key_id when the same thing happens.
Quoted source text, attributed separately from HOL analysis.