CVE-2022-50323: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50323 is a data race vulnerability in the Linux kernel's skb_append_pagefrags() function within the network subsystem. The flaw arises from improper handling of pfmemalloc status for user-space-owned pages, leading to a KCSAN-detected data race between lru_add_fn and skb_append_pagefrags. Affected kernel versions include 5.15.68–5.15.77, 5.19.9–6.0, 6.0.1–6.0.7, and release candidates 6.0-rc5 through 6.1-rc2. It was published on September 15, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a concurrent memory access (CWE-362: Race Condition) in skb_append_pagefrags(), which is used by the af_unix and UDP sendpage() implementations. The function incorrectly senses pfmemalloc status for pages owned by user space — a pattern previously corrected for TCP in commit 326140063946. The fix requires replacing the page descriptor fill call with skb_fill_page_desc_noacc() to avoid unsynchronized access to LRU list structures during concurrent memory reclaim operations. KCSAN (Kernel Concurrency Sanitizer) reported the race as a write conflict between lru_add_fn (in mm/swap.c) and skb_append_pagefrags (Feedly, Kernel Patch 1).

A local attacker with low privileges could exploit this race condition to cause kernel instability or a denial-of-service condition, such as a kernel crash or system hang. The vulnerability has a high availability impact with no confidentiality or integrity impact, meaning it cannot be used to exfiltrate data or modify system state, but can disrupt system operation. The affected scope is limited to the local system, with no lateral movement potential (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017%, reflecting a very low probability of exploitation in the near term (Feedly).

Patches are available for multiple stable Linux kernel branches. Administrators should upgrade to kernel version 5.15.77, 6.0.7, or any later stable release. Three upstream commits address the issue: 228ebc4, 847a285, and 92b4c5c. As a secondary measure, restricting local user access to reduce the attack surface is advisable until patching is complete (Feedly, Kernel Patch 1).

SUSE issued a security advisory (SUSE-2025-03615-1) addressing this vulnerability in their kernel packages, indicating vendor acknowledgment and downstream patching activity (Linux Security SUSE Advisory). Tenable's Nessus scanner has detection plugins for this CVE (plugin IDs 278477, 278473, 278484, 281579, 281563), reflecting integration into enterprise vulnerability management workflows (Feedly). No notable researcher commentary or broader media coverage has been identified.