{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-50650", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-08T23:57:43.371Z", "datePublished": "2025-12-09T00:00:24.598Z", "dateUpdated": "2026-08-05T08:59:14.920Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:59:14.920Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix reference state management for synchronous callbacks\n\nCurrently, verifier verifies callback functions (sync and async) as if\nthey will be executed once, (i.e. it explores execution state as if the\nfunction was being called once). The next insn to explore is set to\nstart of subprog and the exit from nested frame is handled using\ncurframe > 0 and prepare_func_exit. In case of async callback it uses a\ncustomized variant of push_stack simulating a kind of branch to set up\ncustom state and execution context for the async callback.\n\nWhile this approach is simple and works when callback really will be\nexecuted only once, it is unsafe for all of our current helpers which\nare for_each style, i.e. they execute the callback multiple times.\n\nA callback releasing acquired references of the caller may do so\nmultiple times, but currently verifier sees it as one call inside the\nframe, which then returns to caller. Hence, it thinks it released some\nreference that the cb e.g. got access through callback_ctx (register\nfilled inside cb from spilled typed register on stack).\n\nSimilarly, it may see that an acquire call is unpaired inside the\ncallback, so the caller will copy the reference state of callback and\nthen will have to release the register with new ref_obj_ids. But again,\nthe callback may execute multiple times, but the verifier will only\naccount for acquired references for a single symbolic execution of the\ncallback, which will cause leaks.\n\nNote that for async callback case, things are different. While currently\nwe have bpf_timer_set_callback which only executes it once, even for\nmultiple executions it would be safe, as reference state is NULL and\ncheck_reference_leak would force program to release state before\nBPF_EXIT. The state is also unaffected by analysis for the caller frame.\nHence async callback is safe.\n\nSince we want the reference state to be accessible, e.g. for pointers\nloaded from stack through callback_ctx's PTR_TO_STACK, we still have to\ncopy caller's reference_state to callback's bpf_func_state, but we\nenforce that whatever references it adds to that reference_state has\nbeen released before it hits BPF_EXIT. This requires introducing a new\ncallback_ref member in the reference state to distinguish between caller\nvs callee references. Hence, check_reference_leak now errors out if it\nsees we are in callback_fn and we have not released callback_ref refs.\nSince there can be multiple nested callbacks, like frame 0 -> cb1 -> cb2\netc. we need to also distinguish between whether this particular ref\nbelongs to this callback frame or parent, and only error for our own, so\nwe store state->frameno (which is always non-zero for callbacks).\n\nIn short, callbacks can read parent reference_state, but cannot mutate\nit, to be able to use pointers acquired by the caller. They must only\nundo their changes (by releasing their own acquired_refs before\nBPF_EXIT) on top of caller reference_state before returning (at which\npoint the caller and callback state will match anyway, so no need to\ncopy it back to caller)." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is in the BPF verifier’s handling of synchronous callbacks and is reached by loading a crafted eBPF program via the local bpf() syscall (then running/attaching it). Per kernel guidance, BPF verifier bugs are Local, not network-reachable.\nAC:L - The attacker fully controls the program, map contents, and callback logic; with a multi-element map (e.g. 16 entries), the callback deterministically releases the same acquired reference multiple times. No race or victim-dependent state is required.\nPR:L - Exercising bpf_for_each_map_elem/bpf_loop with referenced objects needs CAP_BPF (or equivalent BPF load rights), which is commonly available to non-root local users or delegated service accounts without full root. Consistent with other BPF verifier scores, the highest reasonable deployment is PR:L.\nUI:N - The attacker loads and executes the malicious BPF program themselves (e.g. via BPF_PROG_TEST_RUN or an attach point they control); no separate victim action is required.\nS:U - Impact is kernel memory corruption and privilege escalation within the same OS security authority. This is standard local kernel compromise, not a VM/IOMMU boundary escape.\nC:H - The verifier bug allows a callback to under-release-track a caller’s acquired reference so runtime multi-iteration release causes refcount underflow and UAF of sockets/kfunc objects, enabling arbitrary kernel memory disclosure.\nI:H - The same UAF of refcounted kernel objects is exploitable for heap reuse and arbitrary write / control-flow hijacking, as confirmed by the underflow_prog regression case that would release once per map element.\nA:H - Refcount underflow and use-after-free of kernel objects can oops/panic the kernel even without a full exploit, and the attacker can trigger the program repeatedly." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/linux/bpf_verifier.h", "kernel/bpf/verifier.c" ], "versions": [ { "version": "69c087ba6225b574afb6e505b72cb75242a3d844", "lessThan": "4ed5155043c97ac8912bcf67331df87c833fb067", "status": "affected", "versionType": "git" }, { "version": "69c087ba6225b574afb6e505b72cb75242a3d844", "lessThan": "caa176c0953cdfd5ce500fb517ce1ea924a8bc4c", "status": "affected", "versionType": "git" }, { "version": "69c087ba6225b574afb6e505b72cb75242a3d844", "lessThan": "aed931fd3b6e28f19cc140ff90aa5046ee2aa4e1", "status": "affected", "versionType": "git" }, { "version": "69c087ba6225b574afb6e505b72cb75242a3d844", "lessThan": "9d9d00ac29d0ef7ce426964de46fa6b380357d0a", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/linux/bpf_verifier.h", "kernel/bpf/verifier.c" ], "versions": [ { "version": "5.13", "status": "affected" }, { "version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.75", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.19.17", "lessThanOrEqual": "5.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.0.3", "lessThanOrEqual": "6.0.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.15.75" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.19.17" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.0.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.1" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/4ed5155043c97ac8912bcf67331df87c833fb067" }, { "url": "https://git.kernel.org/stable/c/caa176c0953cdfd5ce500fb517ce1ea924a8bc4c" }, { "url": "https://git.kernel.org/stable/c/aed931fd3b6e28f19cc140ff90aa5046ee2aa4e1" }, { "url": "https://git.kernel.org/stable/c/9d9d00ac29d0ef7ce426964de46fa6b380357d0a" } ], "title": "bpf: Fix reference state management for synchronous callbacks", "x_generator": { "engine": "bippy-1.2.0" } } } }