CVE-2022-50764: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50764 is a data race vulnerability in the Linux kernel's IPv6 SIT (Simple Internet Transition) tunnel driver (ipv6/sit). The flaw arises because SIT tunnels use the NETIF_F_LLTX flag, meaning their ndo_start_xmit() function is not protected by a spinlock, allowing multiple CPUs to concurrently update network device statistics (e.g., dev->stats.tx_error) without synchronization. The issue affects both the transmit (TX) and receive (RX) paths. It was publicly disclosed on December 24, 2025, and the CVSS base score is listed as 0.0 (no severity rating assigned at time of publication) (Feedly, ENISA EUVD).

The root cause is a concurrent access (data race) condition — classified under CWE-362 (Race Condition / Concurrent Execution Using Shared Resource with Improper Synchronization) — in the Linux kernel's net/ipv6/sit.c driver. Because SIT tunnels declare NETIF_F_LLTX (lockless TX), the kernel does not acquire a per-device spinlock before calling ndo_start_xmit(), so multiple CPU cores can simultaneously read-modify-write the dev->stats counters. The fix replaces direct stat updates with the atomic DEV_STATS_INC() helper to ensure race-free increments. The issue was originally detected by syzbot and KCSAN (Kernel Concurrency Sanitizer) (Feedly). Patches are available in the stable kernel tree for versions 5.15.86, 6.0.16, 6.1.2, and 6.2 (ENISA EUVD).

The primary impact of this vulnerability is on system stability and data integrity of kernel network statistics, rather than confidentiality or privilege escalation. Concurrent unsynchronized writes to dev->stats counters can result in corrupted or inaccurate network statistics, and in rare cases may contribute to kernel instability on multi-core systems using IPv6 SIT tunnels. There is no known direct path to privilege escalation, remote code execution, or sensitive data disclosure from this vulnerability (Feedly).

The Linux kernel maintainers have released fixes in the following stable versions: 5.15.86, 6.0.16, 6.1.2, and 6.2. The fix replaces non-atomic stat counter updates with DEV_STATS_INC() in net/ipv6/sit.c for both TX and RX paths. Administrators should update their Linux kernel to one of the patched versions. As a workaround, disabling IPv6 SIT tunnels (ip tunnel del or avoiding NETIF_F_LLTX tunnel configurations) can reduce exposure on unpatched systems (ENISA EUVD, Feedly).