{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2022-50536",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2022-50536",
    "idYear": 2022,
    "status": "PUBLISHED",
    "publishedAt": "2025-10-07T15:21:03.056Z",
    "updatedAt": "2026-08-05T08:59:05.133Z",
    "importedAt": "2026-10-24T01:56:49.724Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix repeated calls to sock_put() when msg has more_data\n\nIn tcp_bpf_send_verdict() redirection, the eval variable is assigned to\n__SK_REDIRECT after the apply_bytes data is sent, if msg has more_data,\nsock_put() will be called multiple times.\n\nWe should reset the eval variable to __SK_NONE every time more_data\nstarts.\n\nThis causes:\n\nIPv4: Attempt to release TCP socket in state 1 00000000b4c925d7\n------------[ cut here ]------------\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 5 PID: 4482 at lib/refcount.c:25 refcount_warn_saturate+0x7d/0x110\nModules linked in:\nCPU: 5 PID: 4482 Comm: sockhash_bypass Kdump: loaded Not tainted 6.0.0 #1\nHardware name: Red Hat KVM, BIOS 1.11.0-2.el7 04/01/2014\nCall Trace:\n <TASK>\n __tcp_transmit_skb+0xa1b/0xb90\n ? __alloc_skb+0x8c/0x1a0\n ? __kmalloc_node_track_caller+0x184/0x320\n tcp_write_xmit+0x22a/0x1110\n __tcp_push_pending_frames+0x32/0xf0\n do_tcp_sendpages+0x62d/0x640\n tcp_bpf_push+0xae/0x2c0\n tcp_bpf_sendmsg_redir+0x260/0x410\n ? preempt_count_add+0x70/0xa0\n tcp_bpf_send_verdict+0x386/0x4b0\n tcp_bpf_sendmsg+0x21b/0x3b0\n sock_sendmsg+0x58/0x70\n __sys_sendto+0xfa/0x170\n ? xfd_validate_state+0x1d/0x80\n ? switch_fpu_return+0x59/0xe0\n __x64_sys_sendto+0x24/0x30\n do_syscall_64+0x37/0x90\n entry_SYSCALL_64_after_hwframe+0x63/0xcd",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "5f0bfe21c853917aae4bc5a70fe57ddb4054443e",
              "status": "affected",
              "versionType": "git",
              "lessThan": "7508b9f4daac4ec7dfe0b6fb2d688b1c1c105e10"
            },
            {
              "version": "15dec6d8f8642a26d6a272af2d7f9877df8f02b8",
              "status": "affected",
              "versionType": "git",
              "lessThan": "28e4a763cd4a2b1a78852216ef4bd7df3a05cec6"
            },
            {
              "version": "cd9733f5d75c94a32544d6ce5be47e14194cf137",
              "status": "affected",
              "versionType": "git",
              "lessThan": "8786bde11a4f31b63b3036731df0b47337a7a245"
            },
            {
              "version": "cd9733f5d75c94a32544d6ce5be47e14194cf137",
              "status": "affected",
              "versionType": "git",
              "lessThan": "578a7628b838a3ac8ad61deaab5a816ff032ac13"
            },
            {
              "version": "cd9733f5d75c94a32544d6ce5be47e14194cf137",
              "status": "affected",
              "versionType": "git",
              "lessThan": "113236e8f49f262f318c00ebb14b15f4834e87c1"
            },
            {
              "version": "cd9733f5d75c94a32544d6ce5be47e14194cf137",
              "status": "affected",
              "versionType": "git",
              "lessThan": "7a9841ca025275b5b0edfb0b618934abb6ceec15"
            },
            {
              "version": "6f226ffe4458ea3b8c33287cb8c86f87dc198dce",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "5.4.157",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "5.4.229"
            },
            {
              "version": "5.10.77",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "5.10.163"
            },
            {
              "version": "5.14.16",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "5.15"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "5.15",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "5.15"
            },
            {
              "version": "5.4.229",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "version": "5.10.163",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "version": "5.15.86",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "version": "6.0.16",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.0.*"
            },
            {
              "version": "6.1.2",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "version": "6.2",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}