CoreCVE
Back

HIGH

tcp: fix a signed-integer-overflow bug in tcp_add_backlog()

Published Dec 30, 2025

Description

The type of sk_rcvbuf and sk_sndbuf in struct sock is int, and in tcp_add_backlog(), the variable limit is caculated by adding sk_rcvbuf, sk_sndbuf and 64 * 1024, it may exceed the max value of int and overflow. This patch reduces the limit budget by halving the sndbuf to solve this issue since ACK packets are much smaller than the payload.

Affected products

Remediation

Red Hat statement

A signed integer overflow in tcp_add_backlog() could occur when computing the backlog limit from sk_rcvbuf and sk_sndbuf, potentially resulting in an incorrect, reduced limit. A remote peer can trigger this condition by sending network traffic that stresses the TCP backlog, leading to premature packet drops and degraded service availability. This issue is a typical network robustness bug, as the integer overflow only affects internal backlog limit calculations and can at most cause packet drops or limited service degradation (DoS), without providing a realistic path to host crashes, memory corruption, privilege escalation, or code execution.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (1)

CWE-190

Integer Overflow

References (10)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Linux
Published Dec 30, 2025
Updated Aug 5, 2026
Reserved Dec 30, 2025
Link CVE-2022-50865
CISA Vulnrichment
Updated Jun 16, 2026
NVD
Status Deferred
Modified Aug 4, 2026
Link CVE-2022-50865
Red Hat
Severity Moderate
Public date Dec 30, 2025
Links CVE-2022-50865 - Bugzilla
ENISA EUVD
Assigner n/a
Published n/a
Updated n/a
Exploited since n/a
Link n/a