BlackTreeIndependent security intelligence

Full vulnerability report · 2025

CVE-2022-50816High confidence

ipv6: ensure sane device mtu in tunnels

Linux · Linux

…UnscoredAssess manually

Recommended action

Needs assessment

No CVSS base score is available from the CNA, CISA ADP or NIST. Absence of a score is not evidence of low risk; review the vendor advisory, affected exposure and exploit evidence.

Patch available

Distribution package intelligence

Ubuntu vendor package status

Canonical’s release and source-package findings are shown separately from local repository availability.

9 package states

Repository candidate not checked

A published vendor fix does not prove that a matching update is enabled and installable on a particular asset. Confirm the local package candidate before scheduling remediation.

Ubuntu release	Source package	Vendor state	Fixed version	Evidence
Ubuntu 24.04 LTSnoble · standard archive	`linux-azure-6.11`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 9 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-gcp-6.11`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 9 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-hwe-6.11`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 9 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-lowlatency-hwe-6.11`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 9 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-nvidia-6.11`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 9 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-oem-6.11`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 9 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-raspi-realtime`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 9 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-realtime`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 9 Sept 2026
Ubuntu 24.04 LTSnoble · standard archive	`linux-riscv`	Affected, no fix publishedCanonical OVAL identifies this running kernel flavour as affected and does not publish a fixed package version in this definition.	`Not published in this feed`	Canonical record ↗Source updated 9 Sept 2026

Official European source

ENISA European Vulnerability Database

Official EUVD identifiers, advisory evidence and known-exploited context. Missing fields are not treated as evidence of low risk.

1 current

ENISA EUVD identifier

EUVD-2022-55882

No EUVD known-exploited evidence

ENISA has published the identifier mapping but no EUVD description has been stored yet.

EUVD state: Present in the current official mapping
Known exploitation: Not present in the current ENISA EUVD known-exploited dataset. This is not proof of no exploitation.
ENISA score: Not supplied in the stored EUVD record
Advisory evidence: No linked advisory details stored yet

Recommended actionNeeds assessment

No CVSS base score is available from the CNA, CISA ADP or NIST. Absence of a score is not evidence of low risk; review the vendor advisory, affected exposure and exploit evidence.

Patch available

What, why and how

In the Linux kernel, the following vulnerability has been resolved: ipv6: ensure sane device mtu in tunnels Another syzbot report [1] with no reproducer hints at a bug in ip6_gre tunnel (dev:ip6gretap0) Since ipv6 mcast code makes sure to read dev->mtu once and applies a sanity check on it (see commit b9b312a7a451 "ipv6: mcast: better catch silly mtu values"), a remaining possibility is that a layer is able to set dev->mtu to an underflowed value (high order bit set). This could happen indeed in ip6gre_tnl_link_config_route(), ip6_tnl_link_config() and ipip6_tunnel_bind_dev() Make sure to sanitize mtu value in a local variable before it is written once on dev->mtu, as lockless readers could catch wrong temporary value. [1] skbuff: skb_over_panic: text:ffff80000b7a2f38 len:40 put:40 head:ffff000149dcf200 data:ffff000149dcf2b0 tail:0xd8 end:0xc0 dev:ip6gretap0 ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:120 Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 10241 Comm: kworker/1:1 Not tainted 6.0.0-rc7-syzkaller-18095-gbbed346d5a96 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022 Workqueue: mld mld_ifc_work pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : skb_panic+0x4c/0x50 net/core/skbuff.c:116 lr : skb_panic+0x4c/0x50 net/core/skbuff.c:116 sp : ffff800020dd3b60 x29: ffff800020dd3b70 x28: 0000000000000000 x27: ffff00010df2a800 x26: 00000000000000c0 x25: 00000000000000b0 x24: ffff000149dcf200 x23: 00000000000000c0 x22: 00000000000000d8 x21: ffff80000b7a2f38 x20: ffff00014c2f7800 x19: 0000000000000028 x18: 00000000000001a9 x17: 0000000000000000 x16: ffff80000db49158 x15: ffff000113bf1a80 x14: 0000000000000000 x13: 00000000ffffffff x12: ffff000113bf1a80 x11: ff808000081c0d5c x10: 0000000000000000 x9 : 73f125dc5c63ba00 x8 : 73f125dc5c63ba00 x7 : ffff800008161d1c x6 : 0000000000000000 x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000 x2 : ffff0001fefddcd0 x1 : 0000000100000000 x0 : 0000000000000089 Call trace: skb_panic+0x4c/0x50 net/core/skbuff.c:116 skb_over_panic net/core/skbuff.c:125 [inline] skb_put+0xd4/0xdc net/core/skbuff.c:2049 ip6_mc_hdr net/ipv6/mcast.c:1714 [inline] mld_newpack+0x14c/0x270 net/ipv6/mcast.c:1765 add_grhead net/ipv6/mcast.c:1851 [inline] add_grec+0xa20/0xae0 net/ipv6/mcast.c:1989 mld_send_cr+0x438/0x5a8 net/ipv6/mcast.c:2115 mld_ifc_work+0x38/0x290 net/ipv6/mcast.c:2653 process_one_work+0x2d8/0x504 kernel/workqueue.c:2289 worker_thread+0x340/0x610 kernel/workqueue.c:2436 kthread+0x12c/0x158 kernel/kthread.c:376 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Code: 91011400 aa0803e1 a90027ea 94373093 (d4210000)

What

Why

The current structured CVE record identifies a security weakness, but the root cause requires confirmation in the linked vendor material.

How

An attacker operating through the affected interface may attempt exploitation when the stated preconditions are met. If successful, the issue may cause the confidentiality, integrity or availability impact described by the vendor.

What

Why

The current structured CVE record identifies a security weakness, but the root cause requires confirmation in the linked vendor material.

How

Exploit reality and attack path

CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.

Observed exploitation

Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.

No confirmed evidence

No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.

Public PoC / exploit material

Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.

None recorded

No exploit-tagged reference or CISA SSVC proof-of-concept state is currently recorded. Research may still exist outside the structured feeds.

Likely attack path: the affected interface → vulnerable operation → cause the confidentiality, integrity or availability impact described by the vendor
Attack surface: Unspecified
Privileges required: Not stated in the selected CVSS metric
User interaction: Not stated in the selected CVSS metric
Attack complexity: Not stated in the selected CVSS metric
Security boundary: Not stated in the selected CVSS metric
Weakness ? CWE means Common Weakness Enumeration.: CWE not yet assigned
CVSS vector ? CVSS means Common Vulnerability Scoring System. The vector records the metric values used to calculate technical severity.: Not available from the selected scoring authority.
Post-exploitation / living off the land: No specific living-off-the-land technique is confirmed in the structured sources. Monitor normal administration tools for activity inconsistent with the affected service's baseline.

Official authority intelligence

Only matched European and national findings are included. Language selectors and unavailable sources are omitted.

ENISA EUVD · EUVD-2022-55882Official EUVD mapping

0 linked advisory records.

Official EUVD record

CERT-FR · French · CERTFR-2026-AVI-0170Multiples vulnérabilités dans le noyau Linux de SUSE

d?id=CVE-2022-50776 Référence CVE CVE-2022-50777 https://www.cve.org/CVERecord?id=CVE-2022-50777 Référence CVE CVE-2022-50779 https://www.cve.org/CVERecord?id=CVE-2022-50779 Référence CVE CVE-2022-50780 https://www.cve.org/CVERecord?id=CVE-2022-50780 Référence CVE CVE-2022-50781 https://www.cve.org/CVERecord?id=CVE-2022-50781 Référence CVE CVE-2022-50782 https://www.cve.org/CVERecord?id=CVE-2022-50782 Référence CVE CVE-2022-50786 https://www.cve.org/CVERecord?id=CVE-2022-50786 Référence CVE CVE-2022-50809 https://www.cve.org/CVERecord?id=CVE-2022-50809 Référence CVE CVE-2022-50814 https://www.cve.org/CVERecord?id=CVE-2022-50814 Référence CVE CVE-2022-50816 https://www.cve.org/CVERecord?id=CVE-2022-50816 Référence CVE CVE-2022-50819 https://www.cve.org/CVERecord?id=CVE-2022-50819 Référence CVE CVE-2022-50821 https://www.cve.org/CVERecord?id=CVE-2022-50821 Référence CVE CVE-2022-50822 https://www.cve.org/CVERecord?id=CVE-2022-50822 Référence CVE CVE-2022-50823 https://www.cve.org/CVERecord?id=CVE-2022-50823 Référence CVE CVE-2022-50824 https://www.cve.org/CVERecord?id=CVE-2022-50824 Référence CVE CVE-2022-50826 https://www.cve.org/CVERecord?id=CVE-2022-50826 Référence CVE CVE-2022-50827 https://www.cve.org/CVERecord?id=CVE-2022-50827 Référence CVE CVE-2022-50828 https://www.cve.org/CVERecord?id=

Official advisory

Patch and workaround

Operational remediation based on structured source evidence.

Status ? Patch availability is based on structured fixed-version fields and authoritative update references. If no fix is verified, check the vendor advisory before making a change.: Patch available
Affected: c12b395a46646bab69089ce7016ac78177f6001f < 2bab6fa449d16af36d9c9518865f783a15f446c7; c12b395a46646bab69089ce7016ac78177f6001f < 78297d513157a31fd629626fe4cbb85a7dcbb94a; c12b395a46646bab69089ce7016ac78177f6001f < af51fc23a03f02b0c6df09ab0d60f23794436052; c12b395a46646bab69089ce7016ac78177f6001f < 44affe7ede596f078c4f2f41e0d160266ccda818; c12b395a46646bab69089ce7016ac78177f6001f < ad3f1d9bf162c487d23df684852597961b745cae; c12b395a46646bab69089ce7016ac78177f6001f < ccd94bd4939690e24d13e23814bce7ed853a09f3; c12b395a46646bab69089ce7016ac78177f6001f < d89d7ff01235f218dad37de84457717f699dee79; 3.7
Fixed: < 3.7; 4.14.305 ≤ 4.14.*; 4.19.272 ≤ 4.19.*; 5.4.231 ≤ 5.4.*; 5.10.153 ≤ 5.10.*; 5.15.77 ≤ 5.15.*; 6.0.7 ≤ 6.0.*; 6.1 ≤ *
Action: Review the linked authoritative reference and apply the recorded fixed release appropriate to the affected product branch.
Workaround: No verified workaround is recorded. Limit untrusted access and use least privilege until authoritative guidance is available.

Evidence and provenance

Published 30 Dec 2025 · Last source change 11 May 2026, 19:25 UTC · CWE not yet assigned

CVE recordCVE.org · 5.2

CVSS sourceUnavailable

EPSS source

The date BlackTree first stored a score for this CVE from the daily FIRST EPSS feed.

FIRST · tracked since 2026-08-14

European sourceENISA EUVD · EUVD-2022-55882

Product sourceCNA

Remediation sourceCVE/CNA references

CWE sourceUnavailable

NVD statusNVD not scheduled

Missing structured fields: CVSS base score, CWE classification. Missing data is not evidence of low risk; review the primary advisory.

Material change intelligence

What changed after publication

View recent updates →

No material field changes have been recorded since change tracking began. Routine source refreshes and cosmetic edits are intentionally excluded.

2025-12-30CVE published

2026-05-11Fixed release or patch reference recorded

ENISA EUVD · EUVD-2022-55882↗CVE authority or vendor reference↗Official CVE record (CNA and ADP data)↗NVD record↗

Technical terms and abbreviations used in this report

CVE: Common Vulnerabilities and Exposures: the public identifier for one disclosed vulnerability.
CVSS: Common Vulnerability Scoring System: a technical severity framework; it is not patching priority by itself.
EPSS: Exploit Prediction Scoring System: FIRST's estimate of the probability that exploitation activity will be observed in the next 30 days; it is a forecast, not confirmation.
CWE: Common Weakness Enumeration: the standard category describing the underlying software or hardware weakness.
CNA: CVE Numbering Authority: an organisation authorised to assign and publish CVE records.
CISA ADP: Cybersecurity and Infrastructure Security Agency Authorized Data Publisher: structured enrichment added to a CVE record.
NVD: National Vulnerability Database: NIST's enrichment service for CVE records.
CERT / CSIRT: A computer security incident response team that publishes warnings or coordinates incident response.
PoC: Proof of concept: public material that demonstrates or helps reproduce exploitation.
CSAF: Common Security Advisory Framework: a machine-readable format for security advisories.
LoTL: Living off the land: abuse of legitimate tools or system functions during an attack.