What’s Vulnerable › Vulnerabilities

CVE-2022-50167: bpf: fix potential 32-bit overflow when accessing ARRAY map element

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-18 · updated 2026-10-30
• Weakness: CWE-190

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: fix potential 32-bit overflow when accessing ARRAY map element If BPF array map is bigger than 4GB, element pointer calculation can overflow because both index and elem_size are u32. Fix this everywhere by forcing 64-bit multiplication. Extract this formula into separate small helper and use it consistently in various places. Speculative-preventing formula utilizing index_mask trick is left as is, but explicit u64 casts are added in both places.

Affected products

• Linux kernel: from 5.3 before 5.18.18; from 5.19 before 5.19.2 — fixed in 5.18.18, 5.19.2
• Linux: 5.3 — fixed in 6.0

How to fix

Upgrade to a fixed version: Linux kernel 5.18.18, 5.19.2; Linux 6.0. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/063e092534d4c6785228e5b1eb6e9329f66ccbe4
• https://git.kernel.org/stable/c/2157ac13db8d5763835f1663bdabda6de744cba8
• https://git.kernel.org/stable/c/3c7256b880b3a5aa1895fd169a34aa4224a11862
• https://git.kernel.org/stable/c/87ac0d600943994444e24382a87aa19acc4cd3d4
• https://git.kernel.org/stable/c/f665c56e6836933335e5a4513fc9b0bf47cdf81f

Get alerted when CVE-2022-50167 or the next vulnerability affects your stack