CVE-2022-50310: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50310 is a use-after-free (UAF) vulnerability in the Linux kernel's IPv6 multicast routing (ip6mr) module. It occurs during network namespace initialization when addrconf_init_net() fails, leaving net->ipv6.devconf_all pointing to freed memory, which is then accessed by ip6mr_sk_done() during cleanup. Affected kernel versions range from 5.18 up to (but not including) 6.0.6, as well as 6.1-rc1. The vulnerability was published on September 15, 2025, and carries a CVSS v3.1 base score of 7.8 (High) (Feedly).

The root cause is a use-after-free condition (CWE-416) in the Linux kernel's ip6mr subsystem. During setup_net(), addrconf_init_net() allocates devconf_all via kmemdup() and assigns it to net->ipv6.devconf_all, but if __addrconf_sysctl_register() subsequently fails, the allocation is freed while the pointer in net->ipv6.devconf_all remains set. When the error path calls ops_exit_list() → ip6mr_sk_done(), the function dereferences the now-invalid devconf pointer to read devconf->mc_forwarding, triggering a KASAN-detected use-after-free. Exploitation requires local access with low privileges (e.g., the ability to create network namespaces via unshare), and the call trace confirms the path through copy_net_ns → create_new_namespaces → ksys_unshare (Feedly).

Successful exploitation can result in kernel memory corruption, potentially enabling arbitrary code execution in kernel context, system crashes (denial of service), or unauthorized access to sensitive kernel memory. The vulnerability has high impacts on confidentiality, integrity, and availability of the affected system. Because the flaw resides in the kernel, a successful exploit could grant an attacker full control of the host, with potential for container escape in environments where unprivileged user namespaces are permitted (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires local access with at least low-privileged credentials and the ability to trigger network namespace creation (Feedly).

1. Gain local access: Obtain a low-privileged shell on a system running a vulnerable Linux kernel (5.18 ≤ version < 6.0.6 or 6.1-rc1) with unprivileged user namespace creation enabled (/proc/sys/kernel/unprivileged_userns_clone set to 1).
2. Trigger namespace creation: Execute unshare -n or a similar syscall sequence to invoke copy_net_ns() → setup_net(), initiating network namespace initialization.
3. Induce initialization failure: Arrange conditions (e.g., resource exhaustion or specific sysctl configuration) so that __addrconf_sysctl_register() fails within addrconf_init_net(), causing devconf_all to be freed while net->ipv6.devconf_all still holds the stale pointer.
4. Trigger the UAF: The error cleanup path calls ops_exit_list() → igmp6_net_exit() → ip6mr_sk_done(), which dereferences the freed devconf pointer, resulting in a use-after-free read/write in kernel memory.
5. Achieve impact: Depending on heap layout and kernel hardening, the attacker may cause a kernel panic (DoS), leak sensitive kernel memory, or achieve privilege escalation through controlled memory corruption (Feedly).

• Logs: Kernel logs (dmesg) showing BUG: KASAN: use-after-free in ip6mr_sk_done+0x112/0x3a0 with associated stack traces including copy_net_ns, create_new_namespaces, unshare_nsproxy_namespaces.
• Process: Unusual or repeated invocations of unshare or processes creating network namespaces by non-root users, particularly in rapid succession.
• Logs: Kernel oops or panic messages referencing ip6mr_sk_done, rawv6_close, inet6_release, or igmp6_net_exit in the call trace.
• System: Unexpected system reboots or kernel panics on systems with IPv6 multicast routing enabled (Feedly).

The primary remediation is to update the Linux kernel to version 6.0.6 or later, which includes the fix for this UAF. Patches are available via the stable kernel tree at the official kernel git repository (Kernel Patch 1, Kernel Patch 2). As a workaround, administrators can restrict unprivileged user namespace creation by setting /proc/sys/kernel/unprivileged_userns_clone to 0 (where supported), which prevents low-privileged users from triggering the vulnerable code path. Applying vendor-specific security patches (e.g., from Red Hat, Ubuntu, SUSE) is also recommended for distribution-managed kernels (Feedly).