CVE-2022-50167: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50167 is an integer overflow vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) array map implementation. When a BPF array map exceeds 4GB in size, element pointer calculations can overflow because both the index and element size are stored as 32-bit unsigned integers (u32), leading to incorrect memory addressing. The vulnerability affects Linux kernel versions 5.3 through 5.18.17 and 5.19 through 5.19.1. It was published on June 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Microsoft MSRC).

The root cause is an integer overflow or wraparound (CWE-190, mapped to CAPEC-92: Forced Integer Overflow) in the BPF array map element pointer calculation within the Linux kernel. When the map size exceeds 4GB, multiplying a u32 index by a u32 element size overflows the 32-bit result, producing an incorrect pointer offset. The fix enforces 64-bit multiplication throughout the affected code paths and introduces a dedicated helper function to ensure consistent safe arithmetic; the speculative-execution-preventing index_mask logic is preserved but augmented with explicit u64 casts. Exploitation requires local access with low privileges, as an attacker must be able to interact with BPF subsystem calls (Feedly, Kernel Patch 1).

Successful exploitation by a low-privileged local attacker can trigger a denial of service, potentially causing system crashes or hangs due to corrupted memory pointer arithmetic in the BPF array map subsystem. The vulnerability has a high availability impact with no direct confidentiality or integrity impact, meaning attackers cannot directly read or modify data through this flaw alone. The affected scope is limited to the local system running a vulnerable Linux kernel version (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017%, reflecting a very low probability of exploitation in the near term. Exploitation requires local, low-privileged access to a system running a vulnerable kernel version with access to BPF functionality (Feedly).

Update the Linux kernel to version 5.18.18 or later (for the 5.3–5.18.x branch) or 5.19.2 or later (for the 5.19.x branch), which include the fix enforcing 64-bit arithmetic in BPF array map element pointer calculations (Feedly, Kernel Patch 1). Microsoft has also released a patched CBL-Mariner kernel (cbl2_kernel_5.15.186.1-1) for affected Azure Linux environments (Microsoft MSRC). As a short-term workaround where patching is not immediately possible, restrict local user access and limit unprivileged BPF usage via kernel.unprivileged_bpf_disabled=1 sysctl setting.