CVE-2022-50255

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2022-50255", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-09-15T13:58:00.973Z", "datePublished": "2025-09-15T14:02:37.224Z", "dateUpdated": "2026-10-15T21:31:19.566Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:57:58.020Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix reading strings from synthetic events\n\nThe follow commands caused a crash:\n\n # cd /sys/kernel/tracing\n # echo 's:open char file[]' > dynamic_events\n # echo 'hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)' > events/syscalls/sys_enter_openat/trigger'\n # echo 1 > events/synthetic/open/enable\n\nBOOM!\n\nThe problem is that the synthetic event field \"char file[]\" will read\nthe value given to it as a string without any memory checks to make sure\nthe address is valid. The above example will pass in the user space\naddress and the sythetic event code will happily call strlen() on it\nand then strscpy() where either one will cause an oops when accessing\nuser space addresses.\n\nUse the helper functions from trace_kprobe and trace_eprobe that can\nread strings safely (and actually succeed when the address is from user\nspace and the memory is mapped in).\n\nNow the above can show:\n\n packagekitd-1721 [000] ...2. 104.597170: open: file=/usr/lib/rpm/fileattrs/cmake.attr\n in:imjournal-978 [006] ...2. 104.599642: open: file=/var/lib/rsyslog/imjournal.state.tmp\n packagekitd-1721 [000] ...2. 104.626308: open: file=/usr/lib/rpm/fileattrs/debuginfo.attr"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only by writing synthetic-event and hist-trigger commands to local tracefs (`dynamic_events` / `events/*/trigger`) and then hitting the armed tracepoint via local syscalls; there is no network or adjacent-protocol path into `trace_event_raw_event_synth()` / `trace_string()`.\nAC:L - The upstream reproducer is a deterministic sequence of tracefs writes plus ordinary syscalls (e.g. openat); no race or attacker-uncontrollable layout is required for the oops, and for the ring-buffer over-copy path the attacker fully controls both threads mutating the source string.\nPR:L - There is no capable() gate on this path\u2014access is pure tracefs DAC (0640), routinely delegated to non-root principals (Android/Perfetto, ChromeOS debugd, gid=-mounted tracing groups), matching established PR:L scoring for hist/synthetic tracefs bugs.\nUI:N - The attacker creates the synthetic event, installs the hist trigger, enables it, and fires the traced syscall themselves; no separate victim action is required.\nS:U - Impact stays inside the host kernel tracing/ring-buffer authority; this is not a VM escape, IOMMU bypass, or other cross-boundary compromise.\nC:H - Syscall `const char *` fields are stored as raw pointers and then strlen/strscpy'd into the synthetic event; an attacker can pass kernel addresses as syscall arguments so arbitrary NUL-terminated kernel memory is copied into the readable trace buffer.\nI:H - Event size is computed with one strlen and the copy uses a second strlen/strscpy; a concurrent attacker-controlled mutation of the source string yields an out-of-bounds write past the reserved ring-buffer entry, a heap corruption primitive.\nA:H - strlen/strscpy on an unmapped or SMAP-protected address causes a reliable kernel oops/panic (the documented BOOM!), fully denying availability."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/trace_events_synth.c"], "versions": [{"version": "bd82631d7ccdc894af2738e47abcba2cb6e7dea9", "lessThan": "d9c79fbcbdb6cb10c07c85040eaf615180b26c48", "status": "affected", "versionType": "git"}, {"version": "bd82631d7ccdc894af2738e47abcba2cb6e7dea9", "lessThan": "149198d0b884e4606ed1d29b330c70016d878276", "status": "affected", "versionType": "git"}, {"version": "bd82631d7ccdc894af2738e47abcba2cb6e7dea9", "lessThan": "f8bae1853196b52ede50950387f5b48cf83b9815", "status": "affected", "versionType": "git"}, {"version": "bd82631d7ccdc894af2738e47abcba2cb6e7dea9", "lessThan": "0934ae9977c27133449b6dd8c6213970e7eece38", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/trace_events_synth.c"], "versions": [{"version": "5.10", "status": "affected"}, {"version": "0", "lessThan": "5.10", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.75", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.19.17", "lessThanOrEqual": "5.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.0.3", "lessThanOrEqual": "6.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.15.75"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.19.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.0.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d9c79fbcbdb6cb10c07c85040eaf615180b26c48"}, {"url": "https://git.kernel.org/stable/c/149198d0b884e4606ed1d29b330c70016d878276"}, {"url": "https://git.kernel.org/stable/c/f8bae1853196b52ede50950387f5b48cf83b9815"}, {"url": "https://git.kernel.org/stable/c/0934ae9977c27133449b6dd8c6213970e7eece38"}], "title": "tracing: Fix reading strings from synthetic events", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-50255", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:30:43.432856Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:31:19.566Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-50255", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:30:43.432856Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:30:44.029Z"}}], "cna": {"title": "tracing: Fix reading strings from synthetic events", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only by writing synthetic-event and hist-trigger commands to local tracefs (`dynamic_events` / `events/*/trigger`) and then hitting the armed tracepoint via local syscalls; there is no network or adjacent-protocol path into `trace_event_raw_event_synth()` / `trace_string()`.\nAC:L - The upstream reproducer is a deterministic sequence of tracefs writes plus ordinary syscalls (e.g. openat); no race or attacker-uncontrollable layout is required for the oops, and for the ring-buffer over-copy path the attacker fully controls both threads mutating the source string.\nPR:L - There is no capable() gate on this path\u2014access is pure tracefs DAC (0640), routinely delegated to non-root principals (Android/Perfetto, ChromeOS debugd, gid=-mounted tracing groups), matching established PR:L scoring for hist/synthetic tracefs bugs.\nUI:N - The attacker creates the synthetic event, installs the hist trigger, enables it, and fires the traced syscall themselves; no separate victim action is required.\nS:U - Impact stays inside the host kernel tracing/ring-buffer authority; this is not a VM escape, IOMMU bypass, or other cross-boundary compromise.\nC:H - Syscall `const char *` fields are stored as raw pointers and then strlen/strscpy'd into the synthetic event; an attacker can pass kernel addresses as syscall arguments so arbitrary NUL-terminated kernel memory is copied into the readable trace buffer.\nI:H - Event size is computed with one strlen and the copy uses a second strlen/strscpy; a concurrent attacker-controlled mutation of the source string yields an out-of-bounds write past the reserved ring-buffer entry, a heap corruption primitive.\nA:H - strlen/strscpy on an unmapped or SMAP-protected address causes a reliable kernel oops/panic (the documented BOOM!), fully denying availability."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "bd82631d7ccdc894af2738e47abcba2cb6e7dea9", "lessThan": "d9c79fbcbdb6cb10c07c85040eaf615180b26c48", "versionType": "git"}, {"status": "affected", "version": "bd82631d7ccdc894af2738e47abcba2cb6e7dea9", "lessThan": "149198d0b884e4606ed1d29b330c70016d878276", "versionType": "git"}, {"status": "affected", "version": "bd82631d7ccdc894af2738e47abcba2cb6e7dea9", "lessThan": "f8bae1853196b52ede50950387f5b48cf83b9815", "versionType": "git"}, {"status": "affected", "version": "bd82631d7ccdc894af2738e47abcba2cb6e7dea9", "lessThan": "0934ae9977c27133449b6dd8c6213970e7eece38", "versionType": "git"}], "programFiles": ["kernel/trace/trace_events_synth.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.10"}, {"status": "unaffected", "version": "0", "lessThan": "5.10", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.75", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "5.19.17", "versionType": "semver", "lessThanOrEqual": "5.19.*"}, {"status": "unaffected", "version": "6.0.3", "versionType": "semver", "lessThanOrEqual": "6.0.*"}, {"status": "unaffected", "version": "6.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/trace/trace_events_synth.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/d9c79fbcbdb6cb10c07c85040eaf615180b26c48"}, {"url": "https://git.kernel.org/stable/c/149198d0b884e4606ed1d29b330c70016d878276"}, {"url": "https://git.kernel.org/stable/c/f8bae1853196b52ede50950387f5b48cf83b9815"}, {"url": "https://git.kernel.org/stable/c/0934ae9977c27133449b6dd8c6213970e7eece38"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix reading strings from synthetic events\n\nThe follow commands caused a crash:\n\n # cd /sys/kernel/tracing\n # echo 's:open char file[]' > dynamic_events\n # echo 'hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)' > events/syscalls/sys_enter_openat/trigger'\n # echo 1 > events/synthetic/open/enable\n\nBOOM!\n\nThe problem is that the synthetic event field \"char file[]\" will read\nthe value given to it as a string without any memory checks to make sure\nthe address is valid. The above example will pass in the user space\naddress and the sythetic event code will happily call strlen() on it\nand then strscpy() where either one will cause an oops when accessing\nuser space addresses.\n\nUse the helper functions from trace_kprobe and trace_eprobe that can\nread strings safely (and actually succeed when the address is from user\nspace and the memory is mapped in).\n\nNow the above can show:\n\n packagekitd-1721 [000] ...2. 104.597170: open: file=/usr/lib/rpm/fileattrs/cmake.attr\n in:imjournal-978 [006] ...2. 104.599642: open: file=/var/lib/rsyslog/imjournal.state.tmp\n packagekitd-1721 [000] ...2. 104.626308: open: file=/usr/lib/rpm/fileattrs/debuginfo.attr"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.75", "versionStartIncluding": "5.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.19.17", "versionStartIncluding": "5.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.0.3", "versionStartIncluding": "5.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1", "versionStartIncluding": "5.10"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:57:58.020Z"}}}, "cveMetadata": {"cveId": "CVE-2022-50255", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:31:19.566Z", "dateReserved": "2025-09-15T13:58:00.973Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-09-15T14:02:37.224Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/trace/trace_events_synth.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d9c79fbcbdb6cb10c07c85040eaf615180b26c48", "status": "affected", "version": "bd82631d7ccdc894af2738e47abcba2cb6e7dea9", "versionType": "git"}, {"lessThan": "149198d0b884e4606ed1d29b330c70016d878276", "status": "affected", "version": "bd82631d7ccdc894af2738e47abcba2cb6e7dea9", "versionType": "git"}, {"lessThan": "f8bae1853196b52ede50950387f5b48cf83b9815", "status": "affected", "version": "bd82631d7ccdc894af2738e47abcba2cb6e7dea9", "versionType": "git"}, {"lessThan": "0934ae9977c27133449b6dd8c6213970e7eece38", "status": "affected", "version": "bd82631d7ccdc894af2738e47abcba2cb6e7dea9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/trace/trace_events_synth.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.10"}, {"lessThan": "5.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.75", "versionType": "semver"}, {"lessThanOrEqual": "5.19.*", "status": "unaffected", "version": "5.19.17", "versionType": "semver"}, {"lessThanOrEqual": "6.0.*", "status": "unaffected", "version": "6.0.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "31A04601-B8E8-4F81-8415-9142CA0221FA", "versionEndExcluding": "5.15.75", "versionStartIncluding": "5.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "19B4C3A4-E5C3-41DC-BB14-BE72858E7D35", "versionEndExcluding": "5.19.17", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5BCD8201-B847-4442-B894-70D430128DEF", "versionEndExcluding": "6.0.3", "versionStartIncluding": "6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix reading strings from synthetic events\n\nThe follow commands caused a crash:\n\n # cd /sys/kernel/tracing\n # echo 's:open char file[]' > dynamic_events\n # echo 'hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)' > events/syscalls/sys_enter_openat/trigger'\n # echo 1 > events/synthetic/open/enable\n\nBOOM!\n\nThe problem is that the synthetic event field \"char file[]\" will read\nthe value given to it as a string without any memory checks to make sure\nthe address is valid. The above example will pass in the user space\naddress and the sythetic event code will happily call strlen() on it\nand then strscpy() where either one will cause an oops when accessing\nuser space addresses.\n\nUse the helper functions from trace_kprobe and trace_eprobe that can\nread strings safely (and actually succeed when the address is from user\nspace and the memory is mapped in).\n\nNow the above can show:\n\n packagekitd-1721 [000] ...2. 104.597170: open: file=/usr/lib/rpm/fileattrs/cmake.attr\n in:imjournal-978 [006] ...2. 104.599642: open: file=/var/lib/rsyslog/imjournal.state.tmp\n packagekitd-1721 [000] ...2. 104.626308: open: file=/usr/lib/rpm/fileattrs/debuginfo.attr"}], "id": "CVE-2022-50255", "lastModified": "2026-10-15T22:17:29.357", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-50255", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:30:43.432856Z", "version": "2.0.3"}}]}, "published": "2025-09-15T14:15:36.247", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0934ae9977c27133449b6dd8c6213970e7eece38"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/149198d0b884e4606ed1d29b330c70016d878276"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d9c79fbcbdb6cb10c07c85040eaf615180b26c48"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f8bae1853196b52ede50950387f5b48cf83b9815"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: tracing: Fix reading strings from synthetic events", "id": "2395399", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395399"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2022-50255", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-09-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-50255\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-50255\nhttps://lore.kernel.org/linux-cve-announce/2025091550-CVE-2022-50255-c5ec@gregkh/T"], "threat_severity": "Important"}

{"created": "2025-09-17T10:08:16.856371+00:00", "updated": "2025-09-17T10:08:16.856400+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}