CVE-2022-50650

A flaw was found in the Linux kernel's BPF verifier. The verifier incorrectly handles reference state management for synchronous callbacks that execute multiple times (for_each style helpers). This can lead to reference leaks when callbacks acquire references, or double-free conditions when callbacks release caller-owned references multiple times, potentially causing memory corruption or denial of service.

This flaw requires the ability to load BPF programs, which is typically restricted to privileged users or those with CAP_BPF capability. The impact is limited to denial of service through resource exhaustion.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.