GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50706 (GCVE-0-2022-50706)

Vulnerability from cvelistv5 – Published: 2025-12-24 10:55 – Updated: 2026-05-23 15:24
VLAI
Title
net/ieee802154: don't warn zero-sized raw_sendmsg()
Summary
In the Linux kernel, the following vulnerability has been resolved: net/ieee802154: don't warn zero-sized raw_sendmsg() syzbot is hitting skb_assert_len() warning at __dev_queue_xmit() [1], for PF_IEEE802154 socket's zero-sized raw_sendmsg() request is hitting __dev_queue_xmit() with skb->len == 0. Since PF_IEEE802154 socket's zero-sized raw_sendmsg() request was able to return 0, don't call __dev_queue_xmit() if packet length is 0. ---------- #include <sys/socket.h> #include <netinet/in.h> int main(int argc, char *argv[]) { struct sockaddr_in addr = { .sin_family = AF_INET, .sin_addr.s_addr = htonl(INADDR_LOOPBACK) }; struct iovec iov = { }; struct msghdr hdr = { .msg_name = &addr, .msg_namelen = sizeof(addr), .msg_iov = &iov, .msg_iovlen = 1 }; sendmsg(socket(PF_IEEE802154, SOCK_RAW, 0), &hdr, 0); return 0; } ---------- Note that this might be a sign that commit fd1894224407c484 ("bpf: Don't redirect packets with invalid pkt_len") should be reverted, for skb->len == 0 was acceptable for at least PF_IEEE802154 socket.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8b68e53d56697a59b5c53893b53f508bbdf272a0 , < 4a36de8947794fa21435d1e916e089095f3246a8 (git)
Affected: 6204bf78b2a903b96ba43afff6abc0b04d6e0462 , < 791489a5c56396ddfed75fc525066d4738dace46 (git)
Affected: a75987714bd2d8e59840667a28e15c1fa5c47554 , < 34f31a2b667914ab701ca725554a0b447809d7ef (git)
Affected: 72f2dc8993f10262092745a88cb2dd0fef094f23 , < df0da3fc131132b6c32a15c4da4ffa3a5aea1af2 (git)
Affected: fd1894224407c484f652ad456e1ce423e89bb3eb , < 9974d220c5073d035b5469d1d8ecd71da86c7afd (git)
Affected: fd1894224407c484f652ad456e1ce423e89bb3eb , < b12e924a2f5b960373459c8f8a514f887adf5cac (git)
Affected: 5.4.212 , < 5.4.220 (semver)
Affected: 5.10.141 , < 5.10.150 (semver)
Affected: 5.15.65 , < 5.15.75 (semver)
Affected: 5.19.7 , < 5.19.17 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 5.4.220 , ≤ 5.4.* (semver)
Unaffected: 5.10.150 , ≤ 5.10.* (semver)
Unaffected: 5.15.75 , ≤ 5.15.* (semver)
Unaffected: 5.19.17 , ≤ 5.19.* (semver)
Unaffected: 6.0.3 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ieee802154/socket.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4a36de8947794fa21435d1e916e089095f3246a8",
              "status": "affected",
              "version": "8b68e53d56697a59b5c53893b53f508bbdf272a0",
              "versionType": "git"
            },
            {
              "lessThan": "791489a5c56396ddfed75fc525066d4738dace46",
              "status": "affected",
              "version": "6204bf78b2a903b96ba43afff6abc0b04d6e0462",
              "versionType": "git"
            },
            {
              "lessThan": "34f31a2b667914ab701ca725554a0b447809d7ef",
              "status": "affected",
              "version": "a75987714bd2d8e59840667a28e15c1fa5c47554",
              "versionType": "git"
            },
            {
              "lessThan": "df0da3fc131132b6c32a15c4da4ffa3a5aea1af2",
              "status": "affected",
              "version": "72f2dc8993f10262092745a88cb2dd0fef094f23",
              "versionType": "git"
            },
            {
              "lessThan": "9974d220c5073d035b5469d1d8ecd71da86c7afd",
              "status": "affected",
              "version": "fd1894224407c484f652ad456e1ce423e89bb3eb",
              "versionType": "git"
            },
            {
              "lessThan": "b12e924a2f5b960373459c8f8a514f887adf5cac",
              "status": "affected",
              "version": "fd1894224407c484f652ad456e1ce423e89bb3eb",
              "versionType": "git"
            },
            {
              "lessThan": "5.4.220",
              "status": "affected",
              "version": "5.4.212",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.150",
              "status": "affected",
              "version": "5.10.141",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.75",
              "status": "affected",
              "version": "5.15.65",
              "versionType": "semver"
            },
            {
              "lessThan": "5.19.17",
              "status": "affected",
              "version": "5.19.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ieee802154/socket.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.220",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.150",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.220",
                  "versionStartIncluding": "5.4.212",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.150",
                  "versionStartIncluding": "5.10.141",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.75",
                  "versionStartIncluding": "5.15.65",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.17",
                  "versionStartIncluding": "5.19.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.3",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/ieee802154: don\u0027t warn zero-sized raw_sendmsg()\n\nsyzbot is hitting skb_assert_len() warning at __dev_queue_xmit() [1],\nfor PF_IEEE802154 socket\u0027s zero-sized raw_sendmsg() request is hitting\n__dev_queue_xmit() with skb-\u003elen == 0.\n\nSince PF_IEEE802154 socket\u0027s zero-sized raw_sendmsg() request was\nable to return 0, don\u0027t call __dev_queue_xmit() if packet length is 0.\n\n  ----------\n  #include \u003csys/socket.h\u003e\n  #include \u003cnetinet/in.h\u003e\n\n  int main(int argc, char *argv[])\n  {\n    struct sockaddr_in addr = { .sin_family = AF_INET, .sin_addr.s_addr = htonl(INADDR_LOOPBACK) };\n    struct iovec iov = { };\n    struct msghdr hdr = { .msg_name = \u0026addr, .msg_namelen = sizeof(addr), .msg_iov = \u0026iov, .msg_iovlen = 1 };\n    sendmsg(socket(PF_IEEE802154, SOCK_RAW, 0), \u0026hdr, 0);\n    return 0;\n  }\n  ----------\n\nNote that this might be a sign that commit fd1894224407c484 (\"bpf: Don\u0027t\nredirect packets with invalid pkt_len\") should be reverted, for\nskb-\u003elen == 0 was acceptable for at least PF_IEEE802154 socket."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:24:53.997Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4a36de8947794fa21435d1e916e089095f3246a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/791489a5c56396ddfed75fc525066d4738dace46"
        },
        {
          "url": "https://git.kernel.org/stable/c/34f31a2b667914ab701ca725554a0b447809d7ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/df0da3fc131132b6c32a15c4da4ffa3a5aea1af2"
        },
        {
          "url": "https://git.kernel.org/stable/c/9974d220c5073d035b5469d1d8ecd71da86c7afd"
        },
        {
          "url": "https://git.kernel.org/stable/c/b12e924a2f5b960373459c8f8a514f887adf5cac"
        }
      ],
      "title": "net/ieee802154: don\u0027t warn zero-sized raw_sendmsg()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50706",
    "datePublished": "2025-12-24T10:55:20.835Z",
    "dateReserved": "2025-12-24T10:53:15.518Z",
    "dateUpdated": "2026-05-23T15:24:53.997Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50706",
      "date": "2026-09-17",
      "epss": "0.00201",
      "percentile": "0.10252"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50706\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-24T11:15:50.780\",\"lastModified\":\"2026-06-17T05:24:02.413\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/ieee802154: don\u0027t warn zero-sized raw_sendmsg()\\n\\nsyzbot is hitting skb_assert_len() warning at __dev_queue_xmit() [1],\\nfor PF_IEEE802154 socket\u0027s zero-sized raw_sendmsg() request is hitting\\n__dev_queue_xmit() with skb-\u003elen == 0.\\n\\nSince PF_IEEE802154 socket\u0027s zero-sized raw_sendmsg() request was\\nable to return 0, don\u0027t call __dev_queue_xmit() if packet length is 0.\\n\\n  ----------\\n  #include \u003csys/socket.h\u003e\\n  #include \u003cnetinet/in.h\u003e\\n\\n  int main(int argc, char *argv[])\\n  {\\n    struct sockaddr_in addr = { .sin_family = AF_INET, .sin_addr.s_addr = htonl(INADDR_LOOPBACK) };\\n    struct iovec iov = { };\\n    struct msghdr hdr = { .msg_name = \u0026addr, .msg_namelen = sizeof(addr), .msg_iov = \u0026iov, .msg_iovlen = 1 };\\n    sendmsg(socket(PF_IEEE802154, SOCK_RAW, 0), \u0026hdr, 0);\\n    return 0;\\n  }\\n  ----------\\n\\nNote that this might be a sign that commit fd1894224407c484 (\\\"bpf: Don\u0027t\\nredirect packets with invalid pkt_len\\\") should be reverted, for\\nskb-\u003elen == 0 was acceptable for at least PF_IEEE802154 socket.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ieee802154/socket.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8b68e53d56697a59b5c53893b53f508bbdf272a0\",\"lessThan\":\"4a36de8947794fa21435d1e916e089095f3246a8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6204bf78b2a903b96ba43afff6abc0b04d6e0462\",\"lessThan\":\"791489a5c56396ddfed75fc525066d4738dace46\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a75987714bd2d8e59840667a28e15c1fa5c47554\",\"lessThan\":\"34f31a2b667914ab701ca725554a0b447809d7ef\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"72f2dc8993f10262092745a88cb2dd0fef094f23\",\"lessThan\":\"df0da3fc131132b6c32a15c4da4ffa3a5aea1af2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fd1894224407c484f652ad456e1ce423e89bb3eb\",\"lessThan\":\"9974d220c5073d035b5469d1d8ecd71da86c7afd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fd1894224407c484f652ad456e1ce423e89bb3eb\",\"lessThan\":\"b12e924a2f5b960373459c8f8a514f887adf5cac\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.4.212\",\"lessThan\":\"5.4.220\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.10.141\",\"lessThan\":\"5.10.150\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.65\",\"lessThan\":\"5.15.75\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.19.7\",\"lessThan\":\"5.19.17\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ieee802154/socket.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.220\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.150\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.75\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19.17\",\"lessThanOrEqual\":\"5.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0.3\",\"lessThanOrEqual\":\"6.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/34f31a2b667914ab701ca725554a0b447809d7ef\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4a36de8947794fa21435d1e916e089095f3246a8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/791489a5c56396ddfed75fc525066d4738dace46\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9974d220c5073d035b5469d1d8ecd71da86c7afd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b12e924a2f5b960373459c8f8a514f887adf5cac\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/df0da3fc131132b6c32a15c4da4ffa3a5aea1af2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-30T10:36:34+00:00",
      "cve": "CVE-2022-50706",
      "id": "CVE-2022-50706",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/ieee802154: don\u0027t warn zero-sized raw_sendmsg()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50706.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.