CVE-2022-50865

What it actually does

Signed integer overflow in tcp_add_backlog() when sk_rcvbuf + sk_sndbuf + 64*1024 exceeds INT_MAX, due to int-typed socket buffer fields in struct sock.

Why it matters to the business

Unpatched kernels risk network stack instability or crashes under high buffer configurations, disrupting connectivity and requiring emergency reboots or maintenance windows.

How an attack unfolds

An attacker establishes TCP connections and manipulates socket buffer settings via system calls or packet patterns that force tcp_add_backlog to compute an overflowing limit value, potentially leading to memory corruption.

How to fix it

Apply the upstream fix by updating to a kernel containing commit 9d04b4d0feee12bce6bfe37f30d8e953d3c30368 or later stable releases; rebuild and reboot affected systems.

How to confirm the fix worked

Verify kernel source or running version includes commit 9d04b4d0feee12bce6bfe37f30d8e953d3c30368; test tcp_add_backlog paths with large buffer values to confirm no overflow occurs.

Typical attack path

1. Identify target Linux kernel version lacking the fix commit
2. Establish TCP sessions and tune socket options to maximize sk_rcvbuf and sk_sndbuf
3. Trigger backlog queue processing with crafted ACK or data packets
4. Induce integer overflow during limit calculation in tcp_add_backlog

How to detect it

Review kernel crash logs for signs of integer overflow or memory corruption in TCP backlog handling; correlate with unusual socket buffer configurations in process traces.

What your security team should do

• Prioritize kernel updates on all exposed Linux systems within standard change windows
• Monitor upstream stable branches for additional backports of the fix
• Audit custom kernel builds for buffer calculation changes