CVE-2022-50817: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50817 is a NULL pointer dereference vulnerability in the Linux kernel's HSR (High-availability Seamless Redundancy) networking subsystem. The flaw exists in hsr_get_untagged_frame(), where a NULL return value from create_stripped_skb_hsr() is not checked before being passed to skb_clone(), resulting in a kernel crash. It was published on December 30, 2025, and affects the Linux kernel. The CVSS score has not been publicly assigned a severity rating at this time, and the CVE status is listed as Unknown (Feedly, VulDB).

The root cause is a missing NULL pointer check (CWE-476: NULL Pointer Dereference) in the HSR network driver within net/hsr/. Specifically, hsr_get_untagged_frame() calls create_stripped_skb_hsr(), which can return NULL under certain conditions; the returned value is then passed directly to skb_clone() without validation, triggering a general protection fault. The crash was originally identified by syzbot on kernel version 6.0.0-syzkaller-02734-g0326074ff465, with the KASAN report showing a null-ptr-deref in the range [0x0000000000000078-0x000000000000007f]. The fix adds a NULL check before calling skb_clone() and replaces a WARN_ONCE() with netdev_warn_once() (Feedly).

Successful exploitation of this vulnerability causes a kernel panic (general protection fault), resulting in a denial of service (system crash) on affected Linux systems. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise. Systems using the HSR networking protocol are at risk, and the crash can be triggered by a local or network-adjacent attacker capable of influencing HSR packet processing (Feedly).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2022-50817. The vulnerability was originally discovered through syzbot (Google's kernel fuzzing infrastructure), indicating it was found via automated fuzzing rather than active threat actor research. The EPSS score is 0.000180 (very low probability of exploitation), and it is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing a general protection fault with the signature KASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f] and a stack trace referencing skb_clone+0x108/0x3c0 net/core/skbuff.c.
• Process: Unexpected system reboots or kernel panics on systems running HSR networking configurations.
• Network: Anomalous or malformed HSR frames being processed by the affected network interface.

The Linux kernel maintainers have issued patches addressing this vulnerability, with fixes committed to stable kernel branches (commits 35ece858660e, c46f2e0fcd1e, d8b57135fd9f, and ff7ba766758313). Users should update to a patched kernel version that includes these commits. As a workaround, disabling or avoiding the use of the HSR networking subsystem on affected systems can reduce exposure until a patch is applied (Feedly, Tenable).