PT-2025-25999 · Linux+4 · Linux Kernel+4

Published 2021-11-09 · Updated 2026-05-26 · CVE-2022-50073

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference bug has been identified in the Linux kernel, specifically in the tap driver. The issue occurs when the skb->dev field is null, which is required by the dev parse header protocol function. This bug is triggered when tap get user calls virtio net hdr to skb, and the skb->dev field is set after this call. The problem arises because dev parse header protocol needs the skb->dev field to be valid. Setting skb->dev before the call in tap.c resolves the issue.

Recommendations To resolve this issue, set skb->dev before the call to virtio net hdr to skb in tap.c. As a temporary workaround, consider restricting the use of the tap driver until a patch is available.

Exploit

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

AZL-70355

CESA-2021_4356

CVE-2022-50073

RHSA-2021:4356

RHSA-2021_4356

RHSA-2024:9315

RHSA-2024_9315

SUSE-SU-2025:02264-1

SUSE-SU-2025:02321-1

SUSE-SU-2025:02322-1

SUSE-SU-2025:02334-1

SUSE-SU-2025:02537-1

SUSE-SU-2025:2264-1

SUSE-SU-2025_02264-1

SUSE-SU-2025_02334-1

SUSE-SU-2025_02537-1

Affected Products

Centos

Debian

Linux Kernel

Red Hat

Suse

References · 731

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50073.json · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2025:02322-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2022-50073 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-50073 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50073 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:02321-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-50073 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-50073 · Vendor Advisory
• https://git.kernel.org/stable/c/4f61f133f354853bc394ec7d6028adb9b02dd701 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:02334-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-50073 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2022-50073 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-50073 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-50073 · Vendor Advisory
• https://git.kernel.org/stable/c/dd29648fcf69339713f2d25f7014ae905dcdfc18 · Patch