CVE-2022-50409: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50409 is a NULL pointer dereference vulnerability in the Linux kernel's networking subsystem, specifically in the sk_stream_wait_memory function. The flaw occurs when a dead socket's sk_wq (socket wait queue) is accessed after the socket has been closed, leading to a kernel crash. It affects multiple Linux kernel stable branches: versions before 4.14.296, 4.15–4.19.261, 4.20–5.4.219, 5.5–5.10.149, 5.11–5.15.74, 5.16–5.19.16, and 6.0–6.0.2. The vulnerability was published on September 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a NULL pointer dereference (CWE-476) in sk_stream_wait_memory within the Linux kernel's TCP/BPF send path. When a socket is marked as dead (e.g., closed by the peer), the code still attempts to access sock->sk_wq to remove a wait queue entry, but sk_wq may be NULL at that point, triggering a kernel panic. The call trace shows the crash path through tcp_bpf_sendmsg → tcp_bpf_send_verdict → tcp_bpf_sendmsg_redir → tcp_bpf_push → do_tcp_sendpages → sk_stream_wait_memory → remove_wait_queue. The fix adds a check for the dead socket state before accessing sk_wq (Feedly, Kernel Patch).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a system crash (kernel panic) and denial of service. The impact is limited to availability — there is no confidentiality or integrity impact. A local user with low privileges who can send data over a TCP socket using BPF socket redirection can trigger the crash, potentially affecting all processes running on the system (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2022-50409. The vulnerability requires local access with low privileges and is triggered through a specific TCP/BPF code path, limiting its practical exploitability. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the wild. It is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

The Linux kernel maintainers have released patches across all affected stable branches. Fixed versions include 4.14.296, 4.19.262, 5.4.220, 5.10.150, 5.15.75, 5.19.17, and 6.0.3. Patches are available via the kernel stable tree (Kernel Patch). Downstream distributions including SUSE and Amazon Linux 2 have also issued updated kernel packages. Administrators should update to a patched kernel version as soon as possible; no configuration-based workaround is available for this kernel-level flaw (SUSE Advisory, Amazon Linux).