PT-2025-38424 · Linux+2 · Linux Kernel+2

Published 2022-10-28 · Updated 2026-04-20 · CVE-2022-50407

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A stack overflow issue was resolved in the crypto/hisilicon/qm module of the Linux kernel. The vulnerability occurs due to insufficient bounds checking during the use of sscanf, potentially allowing a stack overflow when processing a qos configuration buffer. The maximum length of the qos configuration buffer is 256 bytes, while the destination buffer ('val buffer') was limited to 32 bytes. Increasing the buffer size mitigates the risk of a stack overflow identified through fuzz testing.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Uncontrolled Recursion

Stack Overflow

Weakness Enumeration

CWE-674

CWE-121

Related Identifiers

AZL-71897

BDU:2026-02374

CVE-2022-50407

Affected Products

Debian

Linux Kernel

Hisilicon Qm

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50407.json · Exploit
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2022-50407 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-71897 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-50407 · Vendor Advisory
• https://git.kernel.org/stable/c/fc521abb6ee4b8f06fdfc52646140dab6a2ed334 · Patch
• https://git.kernel.org/stable/c/34c4f8ad45b4ea814c7ecc3f23a2d292959d5a52 · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-50407 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50407 · Security Note
• https://bdu.fstec.ru/vul/2026-02374 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-50407 · Vendor Advisory
• https://git.kernel.org/stable/c/3efe90af4c0c46c58dba1b306de142827153d9c0 · Patch
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2022-50407 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-50407 · Security Note
• https://ubuntu.com/security/CVE-2022-50407 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-50407 · Vendor Advisory