CVE-2022-50865 tcp: fix a signed-integer-overflow bug in tcp_add_backlog()
A signed integer overflow in the Linux kernel TCP backlog handling can lead to a denial of service condition.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50865?
CVE-2022-50865 is a high-severity vulnerability in Linux, published on 30 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix a signed-integer-overflow bug in tcp_add_backlog()
The type of sk_rcvbuf and sk_sndbuf in struct sock is int, and in tcp_add_backlog(), the variable limit is caculated by adding sk_rcvbuf, sk_sndbuf and 64 * 1024, it may exceed the max value of int and overflow. This patch reduces the limit budget by halving the sndbuf to solve this issue since ACK packets are much smaller than the payload.
Which versions are affected by CVE-2022-50865?
How do I fix CVE-2022-50865?
Apply the vendor's patch.
Is CVE-2022-50865 being exploited?
There is no known exploitation of CVE-2022-50865 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2022-50865, GHSA-2qmc-x97c-8pmc, UBUNTU-CVE-2022-50865.