{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2022-50167", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-06-18T10:57:27.426Z", "datePublished": "2025-06-18T11:03:20.997Z", "dateUpdated": "2026-10-30T12:17:09.354Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:17:09.354Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fix potential 32-bit overflow when accessing ARRAY map element\n\nIf BPF array map is bigger than 4GB, element pointer calculation can\noverflow because both index and elem_size are u32. Fix this everywhere\nby forcing 64-bit multiplication. Extract this formula into separate\nsmall helper and use it consistently in various places.\n\nSpeculative-preventing formula utilizing index_mask trick is left as is,\nbut explicit u64 casts are added in both places."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in BPF ARRAY map element pointer math in kernel/bpf/arraymap.c, reached only via the local bpf(2) syscall (map create/lookup/update and map FD release), not via network packet processing.\nAC:L - An attacker who can create a >4GB ARRAY map fully controls map size, indices, timer arming, and FD close, so the 32-bit overflow and resulting bad pointer/timer mishandling are reliably triggerable with no conditions outside their control.\nPR:L - BPF ARRAY map create/use is available to an unprivileged local user when unprivileged BPF is enabled, and the higher-impact timer path needs only CAP_BPF (not full root); when uncertain, the lower privilege requirement is scored.\nUI:N - Exploitation requires only attacker-controlled bpf(2) operations and closing their own map FD; no victim user action is needed.\nS:U - Impact stays within the host kernel\u2019s authority (local memory corruption / privilege escalation); there is no VM, IOMMU, or other security-authority boundary crossed.\nC:H - On map uref drop, array_map_free_timers skips high-index timers due to the overflow, leaving live hrtimers into map memory that is later freed\u2014a use-after-free that can be leveraged for arbitrary kernel read.\nI:H - The same timer use-after-free (and wrong-element update/free of kernel-managed map fields) yields a corruptible kernel object and is exploitable for arbitrary write / control-flow hijacking.\nA:H - A use-after-free in a softirq hrtimer callback can oops/panic the kernel, and guidance treats any UAF as high availability impact even when not fully exploited."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/arraymap.c"], "versions": [{"version": "c85d69135a9175c50a823d04d62d932312d037b3", "lessThan": "2157ac13db8d5763835f1663bdabda6de744cba8", "status": "affected", "versionType": "git"}, {"version": "c85d69135a9175c50a823d04d62d932312d037b3", "lessThan": "f665c56e6836933335e5a4513fc9b0bf47cdf81f", "status": "affected", "versionType": "git"}, {"version": "c85d69135a9175c50a823d04d62d932312d037b3", "lessThan": "063e092534d4c6785228e5b1eb6e9329f66ccbe4", "status": "affected", "versionType": "git"}, {"version": "c85d69135a9175c50a823d04d62d932312d037b3", "lessThan": "3c7256b880b3a5aa1895fd169a34aa4224a11862", "status": "affected", "versionType": "git"}, {"version": "c85d69135a9175c50a823d04d62d932312d037b3", "lessThan": "87ac0d600943994444e24382a87aa19acc4cd3d4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/arraymap.c"], "versions": [{"version": "5.3", "status": "affected"}, {"version": "0", "lessThan": "5.3", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.18.18", "lessThanOrEqual": "5.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.19.2", "lessThanOrEqual": "5.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "5.18.18"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "5.19.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2157ac13db8d5763835f1663bdabda6de744cba8"}, {"url": "https://git.kernel.org/stable/c/f665c56e6836933335e5a4513fc9b0bf47cdf81f"}, {"url": "https://git.kernel.org/stable/c/063e092534d4c6785228e5b1eb6e9329f66ccbe4"}, {"url": "https://git.kernel.org/stable/c/3c7256b880b3a5aa1895fd169a34aa4224a11862"}, {"url": "https://git.kernel.org/stable/c/87ac0d600943994444e24382a87aa19acc4cd3d4"}], "title": "bpf: fix potential 32-bit overflow when accessing ARRAY map element", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-50167", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:30:17.190513Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:31:18.591Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-50167", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:30:17.190513Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:30:18.266Z"}}], "cna": {"title": "bpf: fix potential 32-bit overflow when accessing ARRAY map element", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in BPF ARRAY map element pointer math in kernel/bpf/arraymap.c, reached only via the local bpf(2) syscall (map create/lookup/update and map FD release), not via network packet processing.\nAC:L - An attacker who can create a >4GB ARRAY map fully controls map size, indices, timer arming, and FD close, so the 32-bit overflow and resulting bad pointer/timer mishandling are reliably triggerable with no conditions outside their control.\nPR:L - BPF ARRAY map create/use is available to an unprivileged local user when unprivileged BPF is enabled, and the higher-impact timer path needs only CAP_BPF (not full root); when uncertain, the lower privilege requirement is scored.\nUI:N - Exploitation requires only attacker-controlled bpf(2) operations and closing their own map FD; no victim user action is needed.\nS:U - Impact stays within the host kernel\u2019s authority (local memory corruption / privilege escalation); there is no VM, IOMMU, or other security-authority boundary crossed.\nC:H - On map uref drop, array_map_free_timers skips high-index timers due to the overflow, leaving live hrtimers into map memory that is later freed\u2014a use-after-free that can be leveraged for arbitrary kernel read.\nI:H - The same timer use-after-free (and wrong-element update/free of kernel-managed map fields) yields a corruptible kernel object and is exploitable for arbitrary write / control-flow hijacking.\nA:H - A use-after-free in a softirq hrtimer callback can oops/panic the kernel, and guidance treats any UAF as high availability impact even when not fully exploited."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "c85d69135a9175c50a823d04d62d932312d037b3", "lessThan": "2157ac13db8d5763835f1663bdabda6de744cba8", "versionType": "git"}, {"status": "affected", "version": "c85d69135a9175c50a823d04d62d932312d037b3", "lessThan": "f665c56e6836933335e5a4513fc9b0bf47cdf81f", "versionType": "git"}, {"status": "affected", "version": "c85d69135a9175c50a823d04d62d932312d037b3", "lessThan": "063e092534d4c6785228e5b1eb6e9329f66ccbe4", "versionType": "git"}, {"status": "affected", "version": "c85d69135a9175c50a823d04d62d932312d037b3", "lessThan": "3c7256b880b3a5aa1895fd169a34aa4224a11862", "versionType": "git"}, {"status": "affected", "version": "c85d69135a9175c50a823d04d62d932312d037b3", "lessThan": "87ac0d600943994444e24382a87aa19acc4cd3d4", "versionType": "git"}], "programFiles": ["kernel/bpf/arraymap.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.3"}, {"status": "unaffected", "version": "0", "lessThan": "5.3", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.273", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.224", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "5.18.18", "versionType": "semver", "lessThanOrEqual": "5.18.*"}, {"status": "unaffected", "version": "5.19.2", "versionType": "semver", "lessThanOrEqual": "5.19.*"}, {"status": "unaffected", "version": "6.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/bpf/arraymap.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/2157ac13db8d5763835f1663bdabda6de744cba8"}, {"url": "https://git.kernel.org/stable/c/f665c56e6836933335e5a4513fc9b0bf47cdf81f"}, {"url": "https://git.kernel.org/stable/c/063e092534d4c6785228e5b1eb6e9329f66ccbe4"}, {"url": "https://git.kernel.org/stable/c/3c7256b880b3a5aa1895fd169a34aa4224a11862"}, {"url": "https://git.kernel.org/stable/c/87ac0d600943994444e24382a87aa19acc4cd3d4"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fix potential 32-bit overflow when accessing ARRAY map element\n\nIf BPF array map is bigger than 4GB, element pointer calculation can\noverflow because both index and elem_size are u32. Fix this everywhere\nby forcing 64-bit multiplication. Extract this formula into separate\nsmall helper and use it consistently in various places.\n\nSpeculative-preventing formula utilizing index_mask trick is left as is,\nbut explicit u64 casts are added in both places."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.273", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.224", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.18.18", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.19.2", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.0", "versionStartIncluding": "5.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:17:09.354Z"}}}, "cveMetadata": {"cveId": "CVE-2022-50167", "state": "PUBLISHED", "dateUpdated": "2026-10-30T12:17:09.354Z", "dateReserved": "2025-06-18T10:57:27.426Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-06-18T11:03:20.997Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/bpf/arraymap.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "2157ac13db8d5763835f1663bdabda6de744cba8", "status": "affected", "version": "c85d69135a9175c50a823d04d62d932312d037b3", "versionType": "git"}, {"lessThan": "f665c56e6836933335e5a4513fc9b0bf47cdf81f", "status": "affected", "version": "c85d69135a9175c50a823d04d62d932312d037b3", "versionType": "git"}, {"lessThan": "063e092534d4c6785228e5b1eb6e9329f66ccbe4", "status": "affected", "version": "c85d69135a9175c50a823d04d62d932312d037b3", "versionType": "git"}, {"lessThan": "3c7256b880b3a5aa1895fd169a34aa4224a11862", "status": "affected", "version": "c85d69135a9175c50a823d04d62d932312d037b3", "versionType": "git"}, {"lessThan": "87ac0d600943994444e24382a87aa19acc4cd3d4", "status": "affected", "version": "c85d69135a9175c50a823d04d62d932312d037b3", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/bpf/arraymap.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.3"}, {"lessThan": "5.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "5.18.*", "status": "unaffected", "version": "5.18.18", "versionType": "semver"}, {"lessThanOrEqual": "5.19.*", "status": "unaffected", "version": "5.19.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B02C474E-3473-42B0-8C3A-FE88F36ABE5A", "versionEndExcluding": "5.18.18", "versionStartIncluding": "5.3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A1A2A5A5-4598-4D7E-BA07-4660398D6C8F", "versionEndExcluding": "5.19.2", "versionStartIncluding": "5.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fix potential 32-bit overflow when accessing ARRAY map element\n\nIf BPF array map is bigger than 4GB, element pointer calculation can\noverflow because both index and elem_size are u32. Fix this everywhere\nby forcing 64-bit multiplication. Extract this formula into separate\nsmall helper and use it consistently in various places.\n\nSpeculative-preventing formula utilizing index_mask trick is left as is,\nbut explicit u64 casts are added in both places."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: se corrige un posible desbordamiento de 32 bits al acceder al elemento del mapa de matriz. Si el mapa de matriz BPF supera los 4 GB, el c\u00e1lculo del puntero del elemento puede desbordarse, ya que tanto el \u00edndice como el tama\u00f1o de elem son u32. Se corrige este problema en todas partes forzando la multiplicaci\u00f3n de 64 bits. Se extrae esta f\u00f3rmula en un peque\u00f1o ayudante independiente y se usa de forma consistente en varios lugares. La f\u00f3rmula que evita la especulaci\u00f3n mediante el truco de index_mask se mantiene sin cambios, pero se a\u00f1aden conversiones u64 expl\u00edcitas en ambos lugares."}], "id": "CVE-2022-50167", "lastModified": "2026-10-30T13:17:14.400", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-50167", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:30:17.190513Z", "version": "2.0.3"}}]}, "published": "2025-06-18T11:15:47.010", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/063e092534d4c6785228e5b1eb6e9329f66ccbe4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2157ac13db8d5763835f1663bdabda6de744cba8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3c7256b880b3a5aa1895fd169a34aa4224a11862"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/87ac0d600943994444e24382a87aa19acc4cd3d4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f665c56e6836933335e5a4513fc9b0bf47cdf81f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: bpf: fix potential 32-bit overflow when accessing ARRAY map element", "id": "2373633", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373633"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: fix potential 32-bit overflow when accessing ARRAY map element\nIf BPF array map is bigger than 4GB, element pointer calculation can\noverflow because both index and elem_size are u32. Fix this everywhere\nby forcing 64-bit multiplication. Extract this formula into separate\nsmall helper and use it consistently in various places.\nSpeculative-preventing formula utilizing index_mask trick is left as is,\nbut explicit u64 casts are added in both places."], "name": "CVE-2022-50167", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Under investigation", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-06-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-50167\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-50167\nhttps://lore.kernel.org/linux-cve-announce/2025061827-CVE-2022-50167-e4bf@gregkh/T"], "threat_severity": "Moderate"}