CVE-2022-50405: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50405 is a vulnerability discovered in the Linux kernel affecting the network tunnel subsystem. The issue was identified in September 2025 and involves a race condition in the VXLAN implementation that can lead to a NULL pointer dereference when deleting a VXLAN device during packet reception (NVD).

The vulnerability occurs in the net/tunnel component of the Linux kernel. Specifically, there is a race condition in VXLAN where when deleting a VXLAN device during receiving packets, the sock can be released after obtaining vxlan_sock vs from sk_user_data. This leads to NULL pointer dereferences in subsequent operations like vxlan_ecn_decapsulate() and vxlan_get_sk_family() (NVD).

When exploited, this vulnerability can cause a kernel crash due to NULL pointer dereference, potentially leading to a denial of service condition. The issue affects systems using VXLAN networking functionality (NVD).

The fix involves implementing proper synchronization by waiting for all sk_user_data readers to finish before releasing the sock. This patch has been incorporated into various Linux kernel versions through security updates (Red Hat).