CVE-2022-50706: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50706 is a vulnerability in the Linux kernel's net/ieee802154 subsystem where a zero-sized raw_sendmsg() call on a PF_IEEE802154 raw socket causes a skb_assert_len() warning to be triggered in __dev_queue_xmit() due to an socket buffer (skb) with len == 0 being passed to the transmit path. The issue was discovered via syzbot fuzzing and disclosed on December 24, 2025. Affected versions span multiple stable kernel branches introduced after commit fd1894224407c484 ("bpf: Don't redirect packets with invalid pkt_len"); fixed versions include Linux 5.4.220, 5.10.150, 5.15.75, 5.19.17, 6.0.3, and 6.1. No CVSS score has been assigned by NVD at this time, and the EPSS score is approximately 0.024% (Feedly).

The root cause is insufficient input validation in the raw_sendmsg() function of the IEEE 802.15.4 network subsystem (CWE not formally assigned by NVD). When a local user sends a zero-length message via a PF_IEEE802154 SOCK_RAW socket using sendmsg(), the kernel proceeds to call __dev_queue_xmit() with an skb whose len field is 0, triggering an assertion warning. The fix adds a guard to skip the __dev_queue_xmit() call entirely when the packet length is zero, returning 0 to the caller instead. The vulnerability is related to a behavioral change introduced by commit fd1894224407c484 ("bpf: Don't redirect packets with invalid pkt_len"), which made zero-length skbs invalid in the transmit path even though PF_IEEE802154 sockets previously accepted them (Feedly, kernel.org patch).

Exploitation of this vulnerability by a local user with access to PF_IEEE802154 raw sockets can trigger a kernel warning (WARN_ON) via skb_assert_len(), which may result in kernel log noise or, depending on kernel configuration (e.g., panic_on_warn), a kernel panic causing a denial of service. There is no evidence of confidentiality or integrity impact; the primary risk is availability disruption on systems where IEEE 802.15.4 networking is enabled and accessible to unprivileged users (Feedly).

1. Precondition: Obtain local access to a Linux system with IEEE 802.15.4 kernel support compiled in and accessible raw socket permissions.
2. Craft zero-length sendmsg: Open a PF_IEEE802154 SOCK_RAW socket and call sendmsg() with a zero-length iovec, as demonstrated in the PoC included in the CVE description.
3. Trigger kernel warning: The zero-length skb bypasses the early return and reaches __dev_queue_xmit(), triggering skb_assert_len() WARN_ON in the kernel.
4. Denial of service: On kernels configured with panic_on_warn=1, this causes a kernel panic; otherwise, it produces a kernel warning and stack trace in dmesg (Feedly).

• Logs: Kernel warning messages in dmesg or /var/log/kern.log referencing skb_assert_len() and __dev_queue_xmit() with skb->len == 0 from the net/ieee802154 subsystem.
• Process: Unusual processes opening PF_IEEE802154 SOCK_RAW sockets on systems not expected to use IEEE 802.15.4 networking.
• System: Unexpected kernel panics on systems with panic_on_warn enabled, particularly on hosts without legitimate IEEE 802.15.4 hardware or use cases.

Apply the upstream kernel patches that add a zero-length packet guard in raw_sendmsg(). Fixed versions are available in stable branches: Linux 5.4.220, 5.10.150, 5.15.75, 5.19.17, 6.0.3, and 6.1. The relevant patch commits are available at the kernel.org stable tree. As a workaround on systems that do not require IEEE 802.15.4 networking, the ieee802154 kernel module can be blacklisted to prevent PF_IEEE802154 socket creation (Feedly, kernel.org patch).