CVE-2022-50699: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50699 is a vulnerability in the Linux kernel's SELinux subsystem, specifically in the convert_context() function within the sidtab (Security Identifier Table) implementation. The flaw involves improper memory allocation context handling — the function could call sleeping memory allocation functions (using GFP_KERNEL) from an atomic/interrupt-disabled context, triggering a kernel BUG warning. It affects the Linux kernel (multiple stable branches) and was published on December 24, 2025. The CVSS score has not been publicly assigned at this time, and the CVE status is listed as Unknown (CVE.org).

The root cause is an incorrect memory allocation flag usage in the SELinux convert_context() function (CWE-667: Improper Locking / improper atomic context handling). When SELinux converts SID table entries during a policy reload, convert_context() calls kstrdup() which internally uses kmalloc with GFP_KERNEL, a flag that permits sleeping. However, this can be invoked from an atomic context (e.g., with interrupts disabled or spinlocks held), which is illegal and triggers the kernel's __might_sleep BUG check. The fix enables the function to use either GFP_KERNEL or GFP_ATOMIC depending on the calling context. The vulnerability was observed on a 5.10.0 kernel during a tar operation that triggered inode_doinit_with_dentry → sidtab_context_to_sid → convert_context while in an atomic context (CVE.org).

Exploitation of this vulnerability can cause a kernel BUG/panic, leading to a denial of service (system crash or instability) on affected Linux systems. The impact is primarily an availability concern — an attacker or even a legitimate user triggering SELinux SID table conversion during a policy reload in an atomic context can crash the kernel. There is no known confidentiality or integrity impact, and the vulnerability does not enable privilege escalation or remote code execution (CVE.org).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing BUG: sleeping function called from invalid context with a call trace involving convert_context, sidtab_context_to_sid, and security_context_to_sid_core.
• Logs: Kernel messages referencing SELinux: Converting N SID table entries... immediately preceding a BUG trace.
• Process: System instability or unexpected reboots on systems running SELinux in enforcing/permissive mode during policy reloads.

The fix has been applied to multiple Linux kernel stable branches via patches that enable convert_context() to use both GFP_KERNEL and GFP_ATOMIC depending on the calling context. Administrators should update to a patched kernel version; SUSE has issued advisories (SUSE-2026-0263-1, SUSE-2026-0317-1, SUSE-2026-0411-1) addressing this CVE (Linux Security SUSE). As a workaround, avoiding SELinux policy reloads on heavily loaded systems may reduce the likelihood of triggering the bug, but upgrading the kernel is the recommended remediation.