Answer in brief
CVE-2022-50536 records a High severity (CVSS 7.8) vulnerability in bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:5.15:-:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=5f0bfe21c853917aae4bc5a70fe57ddb4054443e <7508b9f4daac4ec7dfe0b6fb2d688b1c1c105e10 || >=15dec6d8f8642a26d6a272af2d7f9877df8f02b8 <28e4a763cd4a2b1a78852216ef4bd7df3a05cec6 || >=cd9733f5d75c94a32544d6ce5be47e14194cf137 <8786bde11a4f31b63b3036731df0b47337a7a245 || >=cd9733f5d75c94a32544d6ce5be47e14194cf137 <578a7628b838a3ac8ad61deaab5a816ff032ac13 || >=cd9733f5d75c94a32544d6ce5be47e14194cf137 <113236e8f49f262f318c00ebb14b15f4834e87c1 || >=cd9733f5d75c94a32544d6ce5be47e14194cf137 <7a9841ca025275b5b0edfb0b618934abb6ceec15 || 6f226ffe4458ea3b8c33287cb8c86f87dc198dce || >=5.4.157 <5.4.229 || >=5.10.77 <5.10.163 || >=5.14.16 <5.15 | 7508b9f4daac4ec7dfe0b6fb2d688b1c1c105e10, 28e4a763cd4a2b1a78852216ef4bd7df3a05cec6, 8786bde11a4f31b63b3036731df0b47337a7a245, 578a7628b838a3ac8ad61deaab5a816ff032ac13, 113236e8f49f262f318c00ebb14b15f4834e87c1, 7a9841ca025275b5b0edfb0b618934abb6ceec15, 5.4.229, 5.10.163, 5.15 |
| Linux/Linuxgeneric | 5.15 | Not reported |
Published upstream
Oct 7, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 4, 2026
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data In tcp_bpf_send_verdict() redirection, the eval variable is assigned to __SK_REDIRECT after the apply_bytes data is sent, if msg has more_data, sock_put() will be called multiple times. We should reset the eval variable to __SK_NONE every time more_data starts. This causes: IPv4: Attempt to release TCP socket in state 1 00000000b4c925d7 ------------[ cut here ]------------ refcount_t: addition on 0; use-after-free. WARNING: CPU: 5 PID: 4482 at lib/refcount.c:25 refcount_warn_saturate+0x7d/0x110 Modules linked in: CPU: 5 PID: 4482 Comm: sockhash_bypass Kdump: loaded Not tainted 6.0.0 #1 Hardware name: Red Hat KVM, BIOS 1.11.0-2.el7 04/01/2014 Call Trace: <TASK> __tcp_transmit_skb+0xa1b/0xb90 ? __alloc_skb+0x8c/0x1a0 ? __kmalloc_node_track_caller+0x184/0x320 tcp_write_xmit+0x22a/0x1110 __tcp_push_pending_frames+0x32/0xf0 do_tcp_sendpages+0x62d/0x640 tcp_bpf_push+0xae/0x2c0 tcp_bpf_sendmsg_redir+0x260/0x410 ? preempt_count_add+0x70/0xa0 tcp_bpf_send_verdict+0x386/0x4b0 tcp_bpf_sendmsg+0x21b/0x3b0 sock_sendmsg+0x58/0x70 __sys_sendto+0xfa/0x170 ? xfd_validate_state+0x1d/0x80 ? switch_fpu_return+0x59/0xe0 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x37/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Quoted source text, attributed separately from HOL analysis.