CVE-2022-50763 crypto: marvell/octeontx - prevent integer overflows
Integer overflows in the Marvell OcteonTX crypto driver allow local attackers to cause a denial of service via crafted firmware.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50763?
CVE-2022-50763 is a vulnerability in Linux, published on 24 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
crypto: marvell/octeontx - prevent integer overflows
The "code_length" value comes from the firmware file. If your firmware is untrusted realistically there is probably very little you can do to protect yourself. Still we try to limit the damage as much as possible. Also Smatch marks any data read from the filesystem as untrusted and prints warnings if it not capped correctly.
The "code_length * 2" can overflow. The round_up(ucode_size, 16) + sizeof() expression can overflow too. Prevent these overflows.
Which versions are affected by CVE-2022-50763?
How do I fix CVE-2022-50763?
Apply the vendor's patch.
Is CVE-2022-50763 being exploited?
There is no known exploitation of CVE-2022-50763 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2022-50763, GHSA-xp8v-ff5g-65c6, UBUNTU-CVE-2022-50763.