CVE-2022-50749: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50749 is an integer overflow vulnerability in the Linux kernel's process accounting (acct) subsystem, specifically within the encode_comp_t() function. The flaw arises from a type mismatch: comp_t is defined as a 16-bit unsigned integer (__u16), but the intermediate variable exp is typed as int, allowing an overflow when exp exceeds 65,535 before being returned. The vulnerability affects the Linux kernel across a wide range of versions from the initial commit (1da177e4c3f4) up to the patched releases. It was publicly disclosed on December 24, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is an integer overflow (CWE-190) in kernel/acct.c within the encode_comp_t() function. The function encodes a u64 value into a compressed floating-point format (comp_t), but uses an int-typed variable exp for intermediate computation. After shifting (exp <<= MANTSIZE) and adding the value (exp += value), the result is returned as comp_t (__u16); if exp exceeds 65,535, the truncation produces incorrect accounting data and can trigger undefined behavior. Exploitation requires low-privileged local access and no user interaction, as the overflow is triggered through normal process accounting operations (Red Hat CVE, Feedly).

Successful exploitation can cause denial of service (DoS) through system instability or unexpected behavior in the kernel's process accounting subsystem. There is no confidentiality or integrity impact; the primary risk is availability, as the overflow may lead to corrupted accounting records or kernel instability when processing accounting data for processes with large resource values. The impact is limited to the local system and does not facilitate lateral movement or data exfiltration (Red Hat CVE, Feedly).

Patches have been backported and released across multiple stable Linux kernel versions. Administrators should update to one of the following patched releases or later: 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, or 6.2. Vendor-specific patches are also available via Red Hat (tracked under Bugzilla #2425202) and SUSE. As a general hardening measure, limiting local user access and applying the principle of least privilege reduces exposure (Red Hat CVE, Red Hat Bugzilla).