CVE-2022-50877: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-50877 is a use-after-free and NULL pointer dereference vulnerability in the Linux kernel's Broadcom BCM4908 Ethernet network driver (bcm4908_enet). The flaw arises because TX (transmit) statistics are updated before hardware confirms actual packet transmission, creating a race condition where bcm4908_enet_start_xmit() can access a socket buffer (skb) after it has already been freed by bcm4908_enet_poll_tx(). It affects Linux kernel versions from the introduction of the BCM4908 Ethernet driver (commit 4feffeadbcb2) up to the fixes backported into stable releases. The vulnerability was publicly disclosed on December 30, 2025, and no CVSS score has been assigned at this time (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a race condition (CWE-362) combined with a use-after-free (CWE-416) in the bcm4908_enet driver's TX path. When bcm4908_enet_start_xmit() queues a packet and updates TX statistics immediately, there is no guarantee the hardware has consumed the data; concurrently, bcm4908_enet_poll_tx() may free the skb before start_xmit() finishes accessing it. The fix defers TX statistics updates until after the hardware confirms packet consumption, eliminating the race and the potential NULL dereference. Patches are available in the upstream kernel stable tree at commits c9589e18a60c, 2adedc80faec, and ef3556ee16c6 (Red Hat Bugzilla, Kernel Stable).

Successful triggering of this vulnerability can cause kernel panics (system crashes) or memory corruption on systems using BCM4908-based Ethernet hardware during active network packet transmission. The use-after-free condition may lead to unpredictable kernel behavior, including potential data corruption in kernel memory structures. While the vulnerability is local to the network driver subsystem, kernel-level crashes affect the availability of the entire system and could disrupt all services running on the affected host (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting a very low probability of exploitation in the near term. Exploitation would likely require local access or the ability to generate specific network traffic patterns on a system with BCM4908 Ethernet hardware (Red Hat Advisory).

The vulnerability is patched in Linux kernel stable versions 5.15.77, 6.0.7, and 6.1 and later. Administrators should upgrade affected kernels to these versions or any subsequent release containing the fix commits (c9589e18a60c, 2adedc80faec, ef3556ee16c6). For systems that cannot be immediately patched, it is recommended to restrict network operations on BCM4908-based hardware and monitor system logs for kernel panics or errors related to the bcm4908_enet driver (Red Hat Bugzilla, Kernel Stable).