In the Linux kernel, the following vulnerability has been resolved:

ppp: associate skb with a device at tx

Syzkaller triggered flow dissector warning with the following:

r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0))
ioctl$PPPIOCSACTIVE(r0, 0x40107446, &(0x7f0000000240)={0x2, &(0x7f0000000180)=[{0x20, 0x0, 0x0, 0xfffff034}, {0x6}]})
pwritev(r0, &(0x7f0000000040)=[{&(0x7f0000000140)='\x00!', 0x2}], 0x1, 0x0, 0x0)

[ 9.485814] WARNING: CPU: 3 PID: 329 at net/core/flow_dissector.c:1016 __skb_flow_dissect+0x1ee0/0x1fa0
[ 9.485929] skb_get_poff+0x53/0xa0
[ 9.485937] bpf_skb_get_pay_offset+0xe/0x20
[ 9.485944] ? ppp_send_frame+0xc2/0x5b0
[ 9.485949] ? _raw_spin_unlock_irqrestore+0x40/0x60
[ 9.485958] ? __ppp_xmit_process+0x7a/0xe0
[ 9.485968] ? ppp_xmit_process+0x5b/0xb0
[ 9.485974] ? ppp_write+0x12a/0x190
[ 9.485981] ? do_iter_write+0x18e/0x2d0
[ 9.485987] ? __import_iovec+0x30/0x130
[ 9.485997] ? do_pwritev+0x1b6/0x240
[ 9.486016] ? trace_hardirqs_on+0x47/0x50
[ 9.486023] ? __x64_sys_pwritev+0x24/0x30
[ 9.486026] ? do_syscall_64+0x3d/0x80
[ 9.486031] ? entry_SYSCALL_64_after_hwframe+0x63/0xcd

Flow dissector tries to find skb net namespace either via device
or via socket. Neigher is set in ppp_send_frame, so let's manually
use ppp->dev.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00036.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 affected < 7da524781c531ebaf2f94c9dc4c541b82edecfed
d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 affected < 148dcbd3af039ae39c3af697a3183008c7995805
d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 affected < 4b8f3b939266c90f03b7cc7e26a4c28c7b64137b
d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 affected < 18dc946360bfe0de016a59e3cc3ee1f450fceb9d
d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 affected < ee678b1f52f9439e930db2db3fd7e345d03e1a50
d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 affected < 9f225444467b98579cf28d94f4ad053460dfdb84
Linux Linux affected
Version Status Constraints
4.20 affected —
0 unaffected < 4.20
5.4.229 unaffected ≤ 5.4.*
5.10.163 unaffected ≤ 5.10.*
5.15.86 unaffected ≤ 5.15.*
6.0.16 unaffected ≤ 6.0.*
6.1.2 unaffected ≤ 6.1.*
6.2 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/148dcbd3af039ae39c3af697a3183008c7995805 cve-icon cve-icon
https://git.kernel.org/stable/c/18dc946360bfe0de016a59e3cc3ee1f450fceb9d cve-icon cve-icon
https://git.kernel.org/stable/c/4b8f3b939266c90f03b7cc7e26a4c28c7b64137b cve-icon cve-icon
https://git.kernel.org/stable/c/7da524781c531ebaf2f94c9dc4c541b82edecfed cve-icon cve-icon
https://git.kernel.org/stable/c/9f225444467b98579cf28d94f4ad053460dfdb84 cve-icon cve-icon
https://git.kernel.org/stable/c/ee678b1f52f9439e930db2db3fd7e345d03e1a50 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025120938-CVE-2022-50655-746b@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-50655 cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-50655 cve-icon
History

Tue, 23 Dec 2025 14:30:00 +0000

Type Values Removed Values Added
References

Wed, 10 Dec 2025 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low

Tue, 09 Dec 2025 00:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ppp: associate skb with a device at tx Syzkaller triggered flow dissector warning with the following: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSACTIVE(r0, 0x40107446, &(0x7f0000000240)={0x2, &(0x7f0000000180)=[{0x20, 0x0, 0x0, 0xfffff034}, {0x6}]}) pwritev(r0, &(0x7f0000000040)=[{&(0x7f0000000140)='\x00!', 0x2}], 0x1, 0x0, 0x0) [ 9.485814] WARNING: CPU: 3 PID: 329 at net/core/flow_dissector.c:1016 __skb_flow_dissect+0x1ee0/0x1fa0 [ 9.485929] skb_get_poff+0x53/0xa0 [ 9.485937] bpf_skb_get_pay_offset+0xe/0x20 [ 9.485944] ? ppp_send_frame+0xc2/0x5b0 [ 9.485949] ? _raw_spin_unlock_irqrestore+0x40/0x60 [ 9.485958] ? __ppp_xmit_process+0x7a/0xe0 [ 9.485968] ? ppp_xmit_process+0x5b/0xb0 [ 9.485974] ? ppp_write+0x12a/0x190 [ 9.485981] ? do_iter_write+0x18e/0x2d0 [ 9.485987] ? __import_iovec+0x30/0x130 [ 9.485997] ? do_pwritev+0x1b6/0x240 [ 9.486016] ? trace_hardirqs_on+0x47/0x50 [ 9.486023] ? __x64_sys_pwritev+0x24/0x30 [ 9.486026] ? do_syscall_64+0x3d/0x80 [ 9.486031] ? entry_SYSCALL_64_after_hwframe+0x63/0xcd Flow dissector tries to find skb net namespace either via device or via socket. Neigher is set in ppp_send_frame, so let's manually use ppp->dev.
Title ppp: associate skb with a device at tx
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-12-23T13:30:27.480Z

Reserved: 2025-12-08T23:57:43.372Z

Link: CVE-2022-50655

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-12-09T01:16:48.460

Modified: 2025-12-23T14:16:39.583

Link: CVE-2022-50655

cve-icon Redhat

Severity : Low

Publid Date: 2025-12-09T00:00:00Z

Links: CVE-2022-50655 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.