CVE Intelligence
Unknown

CVE-2022-50838 — net: stream: purge sk_error_queue in sk_stream_kill_queues()

In the Linux kernel, the following vulnerability has been resolved: net: stream: purge sk_error_queue in sk_stream_kill_queues() Changheon Lee reported TCP socket leaks, with a nice repro. It seems we leak TCP sockets with the following sequence: 1) SOF_TIMESTAMPING_TX_ACK is enabled on the socket. Each ACK will cook an skb put in error queue, from __skb_tstamp_tx(). __skb_tstamp_tx() is using skb_clone(), unless SOF_TIMESTAMPING_OPT_TSONLY was also requested. 2) If the application is also using MSG_ZEROCOPY, then we put in the error queue cloned skbs that had a struct ubuf_info attached to them. Whenever an struct ubuf_info is allocated, sock_zerocopy_alloc() does a sock_hold(). As long as the cloned skbs are still in sk_error_queue, socket refcount is kept elevated. 3) Application closes the socket, while error queue is not empty. Since tcp_close() no longer purges the socket error queue, we might end up with a TCP socket with at least one skb in error queue keeping the socket alive forever. This bug can be (ab)used to consume all kernel memory and freeze the host. We need to purge the error queue, with proper synchronization against concurrent writers.

Published Dec 30, 2025 · Updated Oct 13, 2026 · Sources: NIST National Vulnerability Database, CVE Program (cve.org) e CISA ADP · CNA: Linux

Who exploits it and how urgent it is

A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.

No exploitation signal in the sources consulted so far.
How the score was calculated
  • EPSS 0.3% (30-day exploitation probability)+3

The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.

Exploitation
Not confirmed
Not in CISA KEV — an absence of record, not proof it is unexploited.
EPSS FIRST
0.28%
ahead of 19% of scored CVEs · Oct 14, 2026
Affects
Linux
Linux
CVSS base
—
Score not published yet.

Remediation

Fixes and mitigations documented by the sources — linked to the original advisory.

No fix documented by the sources we poll. That does not mean none exists: check the vendor advisory.

First 24 hours

Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.

  1. Identify exposed assets running the affected vendor/product/version combinations (Linux Linux).
  2. No fix documented in the sources: reduce exposure and monitor the vendor advisory.
  3. Search available logs for exploit probes, errors and authentication anomalies.

Affected scope

Vendor, product and versions as the sources word them.

VendorProductVersionsStatusSource
Linux Linux version 4437f3ead9e85c35fe0e3adfb98c0b97eaa267ebversion 5.16≥ 5.14.19 and < 5.15≥ 4.4.293 and < 4.5≥ 5.15.3 and < 5.15.86≥ 5.10.80 and < 5.10.163≥ 5.4.160 and < 5.4.229≥ 4.19.218 and < 4.19.270
and 12 more ≥ 4.14.256 and < 4.14.303≥ 4.9.291 and < 4.9.337≥ 7737b104c211fa843de268b897d601e070292a72 and < c8c1eec578a9ae2dc8f14a1846942a0b7bf29d1dversion 6ba975e14f5ebb87143d737c493adf4031409a68≥ 24bcbe1cc69fa52dc4f7b5b2456678ed464724d8 and < e0c8bccd40fc1c19e1d246c39bcf79e357e1ada3≥ 24bcbe1cc69fa52dc4f7b5b2456678ed464724d8 and < b458d349f8753f666233828ebd30df6f100cf7d5≥ 24bcbe1cc69fa52dc4f7b5b2456678ed464724d8 and < 8c330c36b3970d0917f48827fa6c7a9c75aa4602≥ 3988164fe9ddf98ebf5b5cdede91ac38c5f08a7e and < 9da204cd67c4fe97e8aa465d10d5c2e7076f7f42≥ daf15fa1fd997749e881aedd9f03f73a11240e82 and < 9062493811676ee0efe6c74d98f00ca38c4e17d4≥ b631c603b5fb98d2bd709c35d384901965a3dd51 and < 4f1d37ff4226eb99d6b69e9f4518e279e1a851bf≥ 8b8b3d738e450d2c2ccdc75f0ab5a951746c2a96 and < 6f00bd0402a1e3d2d556afba57c045bd7931e4d3≥ 89be5c357de34718eaaaefed80737f432c5ab86f and < bab542cf56fc174c8447c00b73be99ffd66d2d39
Vulnerable CVE Program (cve.org) e CISA ADP

EPSS over time FIRST

Oct 13, 2026 → Oct 14, 2026 · 2 reading(s) · max 0.28%

Detection

Read off the CVSS vector and the weakness class. Starting points, not tested rules.

  • Not enough vector or weakness data: use the affected application’s logs as a starting point.
application logs

Timeline

What happened to this CVE, newest first.

  • 2026
  • Record published
    Oct 13, 2026
  • Affected products added · linux/linux
    Oct 13, 2026 · CVE Program (cve.org) e CISA ADP
  • Source status changed · → Deferred
    Oct 13, 2026 · NIST National Vulnerability Database
  • Record created in this database
    Oct 13, 2026 · NIST National Vulnerability Database
  • 2025
  • CVE published
    Dec 30, 2025 · Linux

Source activity

Repeated readings are counted rather than listed.

  • 1× Official description updated · Oct 13, 2026 – Oct 13, 2026

References

9 on the record

Elsewhere on this site

Linux
every CVE for this vendor

Related CVEs (same products)

  • CVE-2026-99999 ipv4: validate checksum_start before completing checksum 9h
  • CVE-2026-98432 ipv4: free inet_opt and ireq_opt after an RCU grace period 9h
  • CVE-2026-98424 wifi: cfg80211: undo netns switch if renaming the wiphy fails 1d
  • CVE-2026-98425 wifi: mac80211: don't warn when an IBSS has no channel to scan 1d
  • CVE-2026-98426 wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path 1d
  • CVE-2026-98427 net/sched: codel: bound the dropping loop per dequeue call 1d

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

  • No CVSS score published by NVD, the CNA, CISA or GitHub so far.
  • No fixed version, patch or mitigation documented.
  • No CISA SSVC assessment.
  • No CWE classification.
  • No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
  • No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
  • No exploit packet captures, log samples, or incident case IDs supplied.

Answered from this record

Text assembled only from the fields above — no additional claims.

What should defenders know first?

CVE-2022-50838 is "net: stream: purge sk_error_queue in sk_stream_kill_queues()", rated Unknown. It affects Linux (Linux); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. EPSS 0.28% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.

Comments

Moderated technical discussion. Read the community guidelines.

No comments yet.

Sign in or create an account to comment and suggest corrections.