CVE-2022-50865: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50865 is a signed integer overflow vulnerability in the Linux kernel's TCP stack, specifically within the tcp_add_backlog() function. The flaw arises because the limit variable is computed by summing sk_rcvbuf, sk_sndbuf (both of type int in struct sock), and 64 * 1024, which can exceed the maximum value of a signed 32-bit integer and wrap around. The vulnerability affects Linux kernel versions from commit c9c3321257e1 onward, with fixes backported to stable releases 5.4.278, 5.10.153, 5.15.77, 6.0.7, and 6.1. It was publicly disclosed on December 30, 2025, and carries an estimated CVSS severity of Medium (Feedly, ENISA EUVD).

The root cause is a signed integer overflow (CWE-190) in tcp_add_backlog(), where the backlog limit is calculated by adding three values — sk_rcvbuf, sk_sndbuf, and 65536 — all within a signed int context. If the socket buffer sizes are large enough, the sum overflows, producing a negative or unexpectedly small limit value, which can cause incorrect backlog enforcement. The fix halves the sk_sndbuf contribution to the limit calculation, reflecting that ACK packets queued in the backlog are significantly smaller than data payloads, thereby keeping the sum within safe integer bounds (Feedly). Patch commits are available across multiple stable kernel branches via the kernel.org stable tree (Kernel Stable).

The integer overflow in tcp_add_backlog() can result in incorrect backlog limit enforcement, potentially allowing more data than intended to be queued in the socket's backlog or causing unexpected kernel behavior. In practice, this could lead to memory exhaustion or denial-of-service conditions on affected systems by disrupting TCP connection handling. Confidentiality and integrity impacts are considered low; the primary risk is availability degradation of network services on the affected host (Feedly).

The Linux kernel maintainers have released patches across multiple stable branches. Users should upgrade to the following fixed versions or later: 5.4.278, 5.10.153, 5.15.77, 6.0.7, or 6.1. Major Linux distributions including Red Hat Enterprise Linux (via RHSA-2026:1661, RHSA-2026:1662, RHSA-2026:1946, RHSA-2026:2490, RHSA-2026:2577, RHSA-2026:3277, RHSA-2026:3360, RHSA-2026:3388), AlmaLinux, Rocky Linux, and Oracle Linux have issued kernel update advisories addressing this vulnerability (Red Hat Errata, AlmaLinux). No configuration-based workaround is available; applying the kernel update is the recommended remediation.