CVE-2022-50783: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50783 is a memory leak vulnerability in the Linux kernel's MPTCP (Multipath TCP) subsystem, caused by using the wrong request socket destructor for IPv6 subflows. Specifically, the IPv4 TCP request socket destructor was incorrectly called even when the subflow was IPv6, failing to properly release IPv6-specific options stored in request sockets. The vulnerability affects Linux kernel versions from 5.6 up to (but not including) the patched stable releases: 5.10.163, 5.15.87, 6.0.18, 6.1.4, and 6.2. It was published on December 24, 2025, with an EPSS score of approximately 0.018% (very low), and no CVSS base score has been assigned (Feedly, EUVD).

The root cause is a missing or incorrect destructor assignment in the MPTCP subflow request socket handling code (CWE-401: Missing Release of Memory after Effective Lifetime). When an MPTCP connection uses an IPv6 subflow, the kernel incorrectly invokes the IPv4 TCP request socket destructor (tcp_request_sock_ops) instead of the IPv6-specific one, which does not free IPv6-specific options (such as those stored in inet6_request_sock). This results in a kernel memory leak whenever MPTCP connections are established over IPv6 with advanced IPv6 options. The fix, introduced via commit 79c0949e9a09, ensures the correct destructor is selected based on the address family of the subflow (Feedly, EUVD).

The primary impact of this vulnerability is a kernel memory leak, which can gradually exhaust kernel memory on affected systems over time, potentially leading to degraded system performance or denial of service. The leak is triggered specifically when MPTCP connections are made over IPv6 with advanced IPv6 socket options. There is no known confidentiality or integrity impact; the vulnerability does not enable code execution, privilege escalation, or data exfiltration (Feedly, EUVD).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50783. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require the ability to establish MPTCP connections over IPv6 with specific socket options, which limits the practical attack surface (Feedly).

The Linux kernel maintainers have released fixes in the following stable versions: 5.10.163, 5.15.87, 6.0.18, 6.1.4, and 6.2. Administrators should update to one of these patched kernel versions as soon as possible. As a temporary workaround, disabling MPTCP (net.mptcp.enabled=0 via sysctl) or avoiding IPv6 MPTCP subflows with advanced options can reduce exposure, though upgrading is the recommended remediation (Feedly, EUVD).