CVE-2022-50405: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50405 is a NULL pointer dereference vulnerability in the Linux kernel's VXLAN (Virtual Extensible LAN) tunnel networking subsystem. The flaw arises from a race condition when a VXLAN device is deleted while packets are simultaneously being received, potentially causing the socket (sock) to be released after vxlan_sock is retrieved from sk_user_data, leading to a kernel crash in vxlan_ecn_decapsulate() or vxlan_get_sk_family(). It was published on September 18, 2025, and affects multiple Linux kernel stable branches. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as CWE-476 (NULL Pointer Dereference), triggered by a time-of-check/time-of-use (TOCTOU) race condition in the net/tunnel subsystem. When a VXLAN device is torn down concurrently with packet reception, the socket referenced via sk_user_data can be freed before all readers have finished using it; subsequent calls to vxlan_ecn_decapsulate() or vxlan_get_sk_family() then dereference a NULL or freed pointer, causing a kernel oops. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction, meaning a local user with sufficient permissions to manipulate network interfaces or trigger packet reception during device deletion can trigger the crash. The fix involves ensuring all sk_user_data readers complete before the socket is released (Feedly, Kernel Patch).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a system crash (kernel panic/oops) and denial of service — the primary impact is high availability loss with no confidentiality or integrity impact. The vulnerability affects any Linux system using VXLAN networking (common in virtualized and containerized environments), and a crash could disrupt all workloads on the affected host. There is no evidence of data exfiltration or privilege escalation as a direct consequence (Feedly).

The Linux kernel maintainers have released patches across multiple stable branches. Affected users should upgrade to the following fixed versions or later: 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, or 6.1.2. Nine separate stable-branch commits have been issued to address this race condition. Linux distribution vendors (e.g., Red Hat, Ubuntu, SUSE) are expected to backport these fixes into their respective kernel packages; users should apply the latest kernel updates from their distribution. As a temporary workaround where patching is not immediately possible, avoiding concurrent VXLAN device deletion during active traffic can reduce exposure (Feedly, Kernel Patch).