CVE-2022-50259: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50259 is a use-after-free vulnerability in the Linux kernel's BPF sockmap subsystem, specifically in the sock_map_free() function. The flaw occurs because sock_map_free() calls release_sock(sk) without owning a reference on the socket, creating a race condition that can lead to memory corruption. Affected kernel versions include 5.4.14–5.4.229, 5.5–5.10.163, 5.11–5.15.86, 5.16–6.0.16, and 6.1–6.1.2. It was publicly disclosed on September 15, 2025, and carries a CVSS v3.1 base score of 4.7 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a race condition (CWE-362) in net/core/sock_map.c where sock_map_free() invokes release_sock(sk) without holding a proper reference to the socket object. This mirrors a previously fixed issue in sock_hash_free(), addressed in commit 75e68e5bf2c7 ("bpf, sockhash: Synchronize delete from bucket list on map free"). The race can be triggered locally by a low-privileged user interacting with BPF sockmap operations, causing a refcount decrement to hit zero and triggering a kernel warning (refcount_t: decrement hit 0; leaking memory) as observed via syzbot fuzzing on kernel 6.1.0-rc7. The call trace implicates tcp_release_cb, release_sock, and sock_map_free within the bpf_map_free_deferred workqueue (Red Hat Bugzilla).

Successful exploitation can cause a denial of service by crashing or destabilizing kernel processes, with high availability impact. The vulnerability has no confidentiality or integrity impact, as the primary consequence is memory-related instability or kernel panic triggered by the use-after-free condition. Because exploitation requires local access with low privileges, the blast radius is limited to the affected host, but disruption of critical kernel networking services (sockmap/BPF) is possible (Red Hat Advisory, Red Hat Bugzilla).

• Logs: Kernel log entries containing refcount_t: decrement hit 0; leaking memory or WARNING: CPU: ... at lib/refcount.c:31 refcount_warn_saturate associated with the bpf_map_free_deferred workqueue.
• Process: Unusual kernel worker threads (kworker/u*) exhibiting abnormal behavior related to BPF map operations.
• Logs: Kernel stack traces referencing sock_map_free, tcp_release_cb, or release_sock in dmesg or /var/log/kern.log (Red Hat Bugzilla).

Apply the upstream kernel patches available for the affected stable branches: fixed in versions 5.4.229, 5.10.163, 5.15.86, 6.0.16, and 6.1.2. Patch commits are available in the Linux stable kernel repository. As a short-term workaround, restricting local user access to BPF sockmap functionality (e.g., via CAP_NET_ADMIN or seccomp policies) can reduce exposure. Regularly applying kernel security updates and monitoring kernel logs for refcount warnings is recommended (Red Hat Advisory, git.kernel.org).