CVE-2022-50259

A use-after-free flaw was found in the Linux kernel's BPF sockmap implementation. The sock_map_free() function calls release_sock(sk) without owning a reference on the socket, so a local user able to create and tear down BPF sockmaps can trigger a race condition that causes a use-after-free and a system crash, resulting in a denial of service. Red Hat rates the impact of this issue as Low because exploitation requires local access with high privileges, the race condition is difficult to win, and the demonstrated impact is limited to system availability. This differs from the upstream CVE record, which assigns a higher severity (7.8, including high confidentiality and integrity impact); the available technical evidence, including the syzbot report, shows only an availability impact from the use-after-free and no indication of confidentiality or integrity impact. Red Hat Enterprise Linux 8 and 9, including the kernel-rt variant, are affected. The fix is currently deferred on the affected streams: given the low severity, the high privileges required, and the narrow timing window of the race, a fix will be delivered in a future planned update rather than as an urgent out-of-band fix. The residual risk is that a highly privileged local attacker able to use BPF sockmaps could crash the system, causing a denial of service. Red Hat Enterprise Linux 6, 7, and 10, and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those products.