CVE-2022-50783 mptcp: use proper req destructor for IPv6
A memory leak in the Linux kernel MPTCP IPv6 handling allows remote attackers to cause a denial of service via crafted network traffic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50783?
CVE-2022-50783 is a memory corruption vulnerability in Linux, published on 24 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mptcp: use proper req destructor for IPv6
Before, only the destructor from TCP request sock in IPv4 was called even if the subflow was IPv6.
It is important to use the right destructor to avoid memory leaks with some advanced IPv6 features, e.g. when the request socks contain specific IPv6 options.
Which versions are affected by CVE-2022-50783?
How do I fix CVE-2022-50783?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-50783 being exploited?
There is no known exploitation of CVE-2022-50783 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2022-50783, GHSA-7hfj-fw8x-q6p6, UBUNTU-CVE-2022-50783.