Cloudanix VulnDB

CVE-2022-50862

None

CVSS

—

EPSS

0.2%

Published

Dec 30, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A kernel bug could let specially crafted eBPF data structures cause warnings or loading failures, so updating the kernel prevents potential instability when running advanced programs.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw permits construction of a func_proto BTF type whose return type references a decl_tag, which btf_type_id_size does not handle, resulting in a WARNING and failed BTF validation during btf_parse_type_sec.

Why it matters to the business

Systems relying on eBPF may experience unexpected warnings, failed program loads, or kernel instability until patched; low exploitability reduces immediate ransomware risk but still requires prompt remediation to avoid operational disruptions in kernel environments.

How an attack unfolds

An attacker supplies a crafted BTF object containing a func_proto whose return type is a decl_tag via the bpf syscall; this reaches btf_func_proto_check and btf_parse_type_sec, triggering the invalid path in btf_type_id_size and producing the warning observed by syzkaller.

How to fix it

Upgrade affected Linux kernel trees to commit e9dbb4c539d058852b76937dcd7347d3f38054f2; for listed libffi packages on Debian 11-14 apply version 3.2.1-4. Rebuild and reload any custom BPF programs after the update.

How to confirm the fix worked

Confirm the patch is present by checking the btf.c source for the decl_tag guard in btf_func_proto_check; attempt to load a test BTF object containing a decl_tag return type and verify it is rejected cleanly without WARNING.

Typical attack path

  1. Generate malformed BTF data with decl_tag used as func_proto return type
  2. Invoke bpf_btf_load or equivalent syscall with the object
  3. Enter btf_parse -> btf_parse_type_sec -> btf_check_all_types
  4. Hit btf_func_proto_check and subsequently btf_type_id_size
  5. Trigger WARNING and abort BTF creation

How to detect it

Inspect kernel logs for the exact WARNING at btf_type_id_size+0x2d5/0x9d0 combined with syz-executor or bpf_btf_load call traces; correlate with audit records of bpf syscalls from untrusted processes.

What your security team should do

  • Prioritize kernel updates on all systems exposing BPF to untrusted loaders
  • Monitor for the referenced commit in distribution backports
  • Review and restrict unprivileged BPF loading via sysctl where feasible
  • Include BTF load failures in kernel audit logging for anomaly detection

The record

In the Linux kernel, the following vulnerability has been resolved: bpf: prevent decl_tag from being referenced in func_proto Syzkaller was able to hit the following issue: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 3609 at kernel/bpf/btf.c:1946 btf_type_id_size+0x2d5/0x9d0 kernel/bpf/btf.c:1946 Modules linked in: CPU: 0 PID: 3609 Comm: syz-executor361 Not tainted 6.0.0-syzkaller-02734-g0326074ff465 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 RIP: 0010:btf_type_id_size+0x2d5/0x9d0 kernel/bpf/btf.c:1946 Code: ef e8 7f 8e e4 ff 41 83 ff 0b 77 28 f6 44 24 10 18 75 3f e8 6d 91 e4 ff 44 89 fe bf 0e 00 00 00 e8 20 8e e4 ff e8 5b 91 e4 ff <0f> 0b 45 31 f6 e9 98 02 00 00 41 83 ff 12 74 18 e8 46 91 e4 ff 44 RSP: 0018:ffffc90003cefb40 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000 RDX: ffff8880259c0000 RSI: ffffffff81968415 RDI: 0000000000000005 RBP: ffff88801270ca00 R08: 0000000000000005 R09: 000000000000000e R10: 0000000000000011 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000011 R14: ffff888026ee6424 R15: 0000000000000011 FS: 000055555641b300(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000f2e258 CR3: 000000007110e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> btf_func_proto_check kernel/bpf/btf.c:4447 [inline] btf_check_all_types kernel/bpf/btf.c:4723 [inline] btf_parse_type_sec kernel/bpf/btf.c:4752 [inline] btf_parse kernel/bpf/btf.c:5026 [inline] btf_new_fd+0x1926/0x1e70 kernel/bpf/btf.c:6892 bpf_btf_load kernel/bpf/syscall.c:4324 [inline] __sys_bpf+0xb7d/0x4cf0 kernel/bpf/syscall.c:5010 __do_sys_bpf kernel/bpf/syscall.c:5069 [inline] __se_sys_bpf kernel/bpf/syscall.c:5067 [inline] __x64_sys_bpf+0x75/0xb0 kernel/bpf/syscall.c:5067 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f0fbae41c69 Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc8aeb6228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0fbae41c69 RDX: 0000000000000020 RSI: 0000000020000140 RDI: 0000000000000012 RBP: 00007f0fbae05e10 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000246 R12: 00007f0fbae05ea0 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK> Looks like it tries to create a func_proto which return type is decl_tag. For the details, see Martin's spot on analysis in [0]. 0: https://lore.kernel.org/bpf/CAKH8qBuQDLva_hHxxBuZzyAcYNO4ejhovz6TQeVSk8HY-2SO6g@mail.gmail.com/T/#mea6524b3fcd6298347432226e81b1e6155efc62c

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 5.16.0 6.0.7
SUSE:Linux Enterprise Micro 5.5 kernel-rt 0 5.14.21-150500.13.118.1
SUSE:Linux Enterprise Micro 5.5 kernel-source-rt 0 5.14.21-150500.13.118.1

Related vulnerabilities