CVE-2022-50717: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50717 is an out-of-bounds access vulnerability in the Linux kernel's NVMe-over-TCP target (nvmet-tcp) subsystem. The flaw exists in the nvmet_tcp_handle_h2c_data_pdu() function, where the Transfer Tag (ttag) field is used as an array index to retrieve a command structure without first validating that the value falls within the valid range. The vulnerability was published on December 24, 2025, and affects Linux kernel versions prior to the patched stable releases. Feedly estimates the severity as Medium, with an EPSS score of approximately 0.024% (Feedly).

The root cause is a missing bounds check (CWE-125: Out-of-bounds Read / CWE-787: Out-of-bounds Write) on the ttag (Transfer Tag) field received in an NVMe-over-TCP Host-to-Controller (H2C) data PDU. In nvmet_tcp_handle_h2c_data_pdu(), the kernel uses ttag directly as an index into the command queue array without verifying it is within the allocated range, enabling an attacker with network access to the NVMe-over-TCP target port to supply a crafted PDU with an out-of-range ttag value. The fix, applied across multiple stable kernel branches, adds an explicit bounds check before the array dereference (Feedly, Kernel Git).

Successful exploitation could allow a network-adjacent or remote attacker to trigger an out-of-bounds memory access in the Linux kernel's NVMe-over-TCP target, potentially causing a kernel panic (denial of service) or, in more severe scenarios, reading or corrupting kernel memory. Systems acting as NVMe-over-TCP storage targets are the primary affected assets. The availability impact is the most likely consequence, though memory corruption could theoretically be leveraged for privilege escalation in a targeted attack (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2022-50717. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, indicating a low probability of exploitation in the near term. Exploitation requires network access to an exposed NVMe-over-TCP target port and the ability to send crafted NVMe PDUs (Feedly).

The Linux kernel maintainers have released patches across multiple stable branches. Fixed versions include: 5.4.220, 5.10.150, 5.15.75, 5.19.17, 6.0.3, and 6.1 (mainline). Administrators running NVMe-over-TCP targets should update to a patched kernel version as soon as possible. As a workaround, restricting network access to the NVMe-over-TCP target port (default TCP 4420) via firewall rules to only trusted initiators can reduce exposure. SUSE Linux Enterprise has also issued kernel security updates addressing this CVE (Feedly, Linux Security SUSE).

SUSE Linux has issued multiple kernel security advisories (SUSE-2026-0263, SUSE-2026-0317, SUSE-2026-0350, SUSE-2026-0411, SUSE-2026-0707) that include fixes for CVE-2022-50717, indicating active downstream patching activity. Tenable has published Nessus detection plugins (IDs 279865, 298924, 300384, 300385, 300601, 300653, 300820) for this vulnerability. No notable public researcher commentary or social media discussion has been identified (Linux Security SUSE, Tenable).