CVE-2022-50071: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50071 is a resource leak vulnerability in the Linux kernel's Multipath TCP (MPTCP) implementation. When MPTCP socket creation fails due to a CGROUP_INET_SOCK_CREATE eBPF program, the kernel leaks all associated subflow sockets because the cleanup routine __mptcp_destroy_sock() is not invoked in that code path. The vulnerability affects Linux kernel versions 5.11 through 5.19.3 (fixed in 5.19.4) and has a CVSS v3.1 base score of 7.8 (High) (Feedly, Microsoft MSRC). It was published on June 18, 2025, with patches added to the kernel stable tree in November 2025.

The root cause is improper resource cleanup (CWE-401: Missing Release of Memory after Effective Lifetime) in the MPTCP socket lifecycle. When a CGROUP_INET_SOCK_CREATE eBPF program causes MPTCP socket creation to fail, the code path does not reach __mptcp_destroy_sock(), which is responsible for cleaning up subflow sockets. The fix moves subflow socket cleanup into mptcp_destroy_common(), a helper invoked in every MSK (MPTCP socket) cleanup path, ensuring cleanup occurs regardless of how socket creation fails. The fix also removes an unnecessary list_splice_init intermediate step (Feedly). Exploitation requires local, low-privileged access with no user interaction needed.

A local attacker with low privileges could exploit this vulnerability to exhaust subflow socket resources, potentially causing system instability or denial of service conditions. The CVSS scoring also reflects high confidentiality and integrity impact, suggesting that resource exhaustion could be leveraged to access or corrupt system resources. The vulnerability's scope is limited to the affected system (unchanged scope), but could degrade availability of network services relying on MPTCP (Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires local access, further limiting the practical attack surface.

Update the Linux kernel to version 5.19.4 or later, which includes the fix that moves subflow socket cleanup into mptcp_destroy_common() (Feedly). Patches are available in the kernel stable tree at the referenced git commits. As interim mitigations, restrict local user access, implement strong access controls to limit who can trigger MPTCP socket creation, and monitor for unusual socket or network-related resource consumption. Microsoft's CBL-Mariner kernel (cbl2_kernel_5.15.186.1-1) has also received a patch (Microsoft MSRC).