CVE-2022-50717: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50717 is an out-of-bounds access vulnerability in the Linux kernel's NVMe-over-TCP target (nvmet-tcp) subsystem. The flaw exists in the nvmet_tcp_handle_h2c_data_pdu() function, where the Transfer Tag (ttag) field is used as an array index to retrieve a command structure without first validating that the value falls within the valid range. The vulnerability was published on December 24, 2025, and affects Linux kernel versions prior to the patched stable releases. Feedly estimates the severity as Medium, with an EPSS score of approximately 0.024% (Feedly).

The root cause is a missing bounds check (CWE-125: Out-of-bounds Read / CWE-787: Out-of-bounds Write) on the ttag (Transfer Tag) field received in an NVMe-over-TCP Host-to-Controller (H2C) data PDU. In nvmet_tcp_handle_h2c_data_pdu(), the kernel uses ttag directly as an index into the command queue array without verifying it is within the allocated range, enabling an attacker with network access to the NVMe-over-TCP target port to supply a crafted PDU with an out-of-range ttag value. The fix, applied across multiple stable kernel branches, adds an explicit bounds check before the array dereference (Feedly, Kernel Git).

Successful exploitation could allow a network-adjacent or remote attacker to trigger an out-of-bounds memory access in the Linux kernel's NVMe-over-TCP target, potentially causing a kernel panic (denial of service) or, in more severe scenarios, reading or corrupting kernel memory. Systems acting as NVMe-over-TCP storage targets are the primary affected assets. The availability impact is the most likely consequence, though memory corruption could theoretically be leveraged for privilege escalation in a targeted attack (Feedly).

The Linux kernel maintainers have released patches across multiple stable branches. Fixed versions include: 5.4.220, 5.10.150, 5.15.75, 5.19.17, 6.0.3, and 6.1 (mainline). Administrators running NVMe-over-TCP targets should update to a patched kernel version as soon as possible. As a workaround, restricting network access to the NVMe-over-TCP target port (default TCP 4420) via firewall rules to only trusted initiators can reduce exposure. SUSE Linux Enterprise has also issued kernel security updates addressing this CVE (Feedly, Linux Security SUSE).

SUSE Linux has issued multiple kernel security advisories (SUSE-2026-0263, SUSE-2026-0317, SUSE-2026-0350, SUSE-2026-0411, SUSE-2026-0707) that include fixes for CVE-2022-50717, indicating active downstream patching activity. Tenable has published Nessus detection plugins (IDs 279865, 298924, 300384, 300385, 300601, 300653, 300820) for this vulnerability. No notable public researcher commentary or social media discussion has been identified (Linux Security SUSE, Tenable).