CVE-2022-50816: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50816 is a vulnerability in the Linux kernel's IPv6 tunnel subsystem where insufficient MTU sanitization can lead to an integer underflow, resulting in a kernel panic (skb_over_panic). The flaw affects the ip6gre_tnl_link_config_route(), ip6_tnl_link_config(), and ipip6_tunnel_bind_dev() functions, which could write an underflowed (high-order bit set) value to dev->mtu, causing lockless readers to observe a corrupt temporary value. It was published on December 30, 2025, and affects the Linux kernel across multiple stable branches. The EPSS score is 0.024% (Low), indicating limited exploitation likelihood at this time (Feedly, Vulners RedHat).

The root cause is improper input validation / insufficient sanitization of MTU values in IPv6 GRE and tunnel link configuration functions (CWE-20). When configuring tunnel devices such as ip6gretap0, the MTU calculation can produce an underflowed value (a very large unsigned integer due to subtraction wrap-around), which is then written directly to dev->mtu. Because lockless readers in the IPv6 multicast code (mld_ifc_work) can observe this intermediate corrupt value before any sanity check is applied, the kernel's skbuff layer triggers a skb_over_panic BUG when attempting to allocate a buffer based on the invalid MTU. The fix involves sanitizing the MTU in a local variable before committing it to dev->mtu, consistent with the approach taken in commit b9b312a7a451 ("ipv6: mcast: better catch silly mtu values") (Feedly).

Successful triggering of this vulnerability causes a kernel BUG (skb_over_panic) leading to a system crash and denial of service. The affected asset is any Linux system using IPv6 GRE or SIT tunnel interfaces (e.g., ip6gretap, ip6tnl, sit). There is no evidence of confidentiality or integrity impact; the primary consequence is availability loss through a kernel panic, which could be triggered by a local or network-adjacent actor capable of manipulating tunnel MTU configuration (Feedly).

• Logs: Kernel logs (dmesg / /var/log/kern.log) containing skbuff: skb_over_panic with device name ip6gretap0 or similar IPv6 tunnel interfaces, followed by kernel BUG at net/core/skbuff.c:120.
• Process: Kernel worker thread kworker associated with mld workqueue (mld_ifc_work) appearing in crash traces.
• System: Unexpected system reboots or kernel panics on hosts running IPv6 GRE/SIT tunnel configurations.

Apply the upstream Linux kernel patches that sanitize the MTU value in a local variable before writing to dev->mtu in ip6gre_tnl_link_config_route(), ip6_tnl_link_config(), and ipip6_tunnel_bind_dev(). Patches are available in multiple stable kernel branches via the following commits: 2bab6fa449d1, 44affe7ede59, 78297d513157, ad3f1d9bf162, and af51fc23a03f on kernel.org. As a workaround, administrators can avoid using IPv6 GRE or SIT tunnel interfaces on unpatched systems, or restrict the ability to configure tunnel MTU values to privileged users only (Feedly, Vulners SUSE).