CVE-2022-50655: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50655 is a vulnerability in the Linux kernel's PPP (Point-to-Point Protocol) subsystem where socket buffers (skbs) are not associated with a network device during transmission in ppp_send_frame. This missing association causes the flow dissector to fail when attempting to resolve the network namespace, triggering a kernel warning. The vulnerability affects Linux kernel versions from the initial commit up to the patched stable releases: 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. It was published on December 9, 2025, and carries an estimated CVSS severity of Medium with an EPSS score of 0.00033 (Feedly, CIRCL).

The root cause is a missing device association for socket buffers (skbs) in the ppp_send_frame function of the Linux kernel's PPP driver (CWE classification relates to improper resource handling). The Linux kernel's flow dissector (__skb_flow_dissect) attempts to determine the network namespace of an skb by checking either the associated network device or socket — neither of which is set in ppp_send_frame at transmit time. This was discovered via Syzkaller fuzzing, which reproduced the issue by opening a PPP device, configuring an active filter via PPPIOCSACTIVE, and writing a crafted packet via pwritev, triggering a WARNING at net/core/flow_dissector.c:1016. The fix associates the skb with ppp->dev before transmission (Feedly, Kernel Patch).

Successful triggering of this vulnerability causes a kernel warning (WARN_ON) in the flow dissector path, which can lead to system instability or denial of service on affected Linux systems using the PPP subsystem. The impact is primarily an availability concern — the kernel warning may disrupt normal PPP networking operations. There is no evidence of confidentiality or integrity impact, and the vulnerability does not appear to enable privilege escalation or remote code execution (Feedly).

No public exploit code or weaponized proof-of-concept is known for CVE-2022-50655 beyond the Syzkaller reproducer used during discovery. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is 0.00033, indicating a very low probability of exploitation in the near term (Feedly).

The fix has been backported to multiple stable Linux kernel branches. Users should upgrade to the following patched versions or later: 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, or 6.2. No configuration-based workaround is documented; upgrading the kernel is the recommended remediation. Distributions such as SUSE have also issued advisories tracking this CVE (Feedly, SUSE CVE).