CVE-2022-50310: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50310 is a use-after-free (UAF) vulnerability discovered in the Linux kernel's IPv6 multicast routing functionality, specifically in the ip6mrskdone() function when addrconfinitnet() fails. The vulnerability was disclosed on September 15, 2025 (NVD).

The vulnerability occurs when initialization fails in calling addrconfinitnet(), causing devconfall pointer to be released. Subsequently, when ip6mrskdone() is called to release the net, it directly accesses devconf->mcforwarding, resulting in an invalid pointer access. The issue has been assigned a CVSS v3.1 base score of 7.1 and is classified as CWE-416 (Use After Free) (Red Hat XML).

The vulnerability can lead to a use-after-free condition in the Linux kernel, potentially causing system crashes or memory corruption. When exploited, it could result in denial of service or possible privilege escalation in the affected systems (NVD).

The vulnerability has been patched in the Linux kernel. Red Hat has confirmed that several of their products, including Red Hat Enterprise Linux 6, 7, 8, 9, and 10, are not affected by this vulnerability (Red Hat XML).