CVE-2022-50497 - Vulnerability Details

- binfmt_misc: fix shift-out-of-bounds in check_special_flags

Description

In the Linux kernel, the following vulnerability has been resolved:

binfmt_misc: fix shift-out-of-bounds in check_special_flags

UBSAN reported a shift-out-of-bounds warning:

left shift of 1 by 31 places cannot be represented in type 'int'
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x8d/0xcf lib/dump_stack.c:106
ubsan_epilogue+0xa/0x44 lib/ubsan.c:151
__ubsan_handle_shift_out_of_bounds+0x1e7/0x208 lib/ubsan.c:322
check_special_flags fs/binfmt_misc.c:241 [inline]
create_entry fs/binfmt_misc.c:456 [inline]
bm_register_write+0x9d3/0xa20 fs/binfmt_misc.c:654
vfs_write+0x11e/0x580 fs/read_write.c:582
ksys_write+0xcf/0x120 fs/read_write.c:637
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x34/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x4194e1

Since the type of Node's flags is unsigned long, we should define these
macros with same type too.

Published: 2025-10-04

Score: 7.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 0f1a48994b3e516d5c7fd5d12204fdba7a604771
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< ea6145370be8016755c43aca799815fc4b8c88b1
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 97382a2639b1cd9631f6069061e9d7062cd2b098
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 419b808504c26b3e3342365f34ccd0843e09a7f8
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< dcbc51d31d0afbd45e830e3cf565a7b3ca7bf0d8
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 88cea1676a09f7c45a1438153a126610c33b1590
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< a651bb5ff997b9f02662bcdef3d8b4e6f0d79656
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< a91123d4bda463469f68f0427adabf8108001f94
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 6a46bf558803dd2b959ca7435a5c143efe837217

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`4.9.337`	unaffected	≤ 4.9.*
`4.14.303`	unaffected	≤ 4.14.*
`4.19.270`	unaffected	≤ 4.19.*
`5.4.229`	unaffected	≤ 5.4.*
`5.10.163`	unaffected	≤ 5.10.*
`5.15.86`	unaffected	≤ 5.15.*
`6.0.16`	unaffected	≤ 6.0.*
`6.1.2`	unaffected	≤ 6.1.*
`6.2`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:-::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:rc2::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:rc3::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:rc4::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:rc5::::::

No data.

Vendor	Product	Confidence	Versions
Linux	Linux Kernel	—	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2022-55657	In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: fix shift-out-of-bounds in check_special_flags UBSAN reported a shift-out-of-bounds warning: left shift of 1 by 31 places cannot be represented in type 'int' Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x8d/0xcf lib/dump_stack.c:106 ubsan_epilogue+0xa/0x44 lib/ubsan.c:151 __ubsan_handle_shift_out_of_bounds+0x1e7/0x208 lib/ubsan.c:322 check_special_flags fs/binfmt_misc.c:241 [inline] create_entry fs/binfmt_misc.c:456 [inline] bm_register_write+0x9d3/0xa20 fs/binfmt_misc.c:654 vfs_write+0x11e/0x580 fs/read_write.c:582 ksys_write+0xcf/0x120 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x34/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x4194e1 Since the type of Node's flags is unsigned long, we should define these macros with same type too.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00013.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0f1a48994b3e516d5c7fd5d12204fdba7a604771
https://git.kernel.org/stable/c/419b808504c26b3e3342365f34ccd0843e09a7f8
https://git.kernel.org/stable/c/6a46bf558803dd2b959ca7435a5c143efe837217
https://git.kernel.org/stable/c/88cea1676a09f7c45a1438153a126610c33b1590
https://git.kernel.org/stable/c/97382a2639b1cd9631f6069061e9d7062cd2b098
https://git.kernel.org/stable/c/a651bb5ff997b9f02662bcdef3d8b4e6f0d79656
https://git.kernel.org/stable/c/a91123d4bda463469f68f0427adabf8108001f94
https://git.kernel.org/stable/c/dcbc51d31d0afbd45e830e3cf565a7b3ca7bf0d8
https://git.kernel.org/stable/c/ea6145370be8016755c43aca799815fc4b8c88b1
https://lore.kernel.org/linux-cve-announce/2025100419-CVE-2022-50497-0aee@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2022-50497
https://www.cve.org/CVERecord?id=CVE-2022-50497

History

Thu, 22 Jan 2026 23:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
CPEs		cpe:2.3:o:linux:linux_kernel:2.6.12:-:::::: cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:::::: cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:::::: cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:::::: cpe:2.3:o:linux:linux_kernel:2.6.12:rc5::::::
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'}`

Tue, 23 Dec 2025 13:45:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:o:linux:linux_kernel::::::::

Mon, 06 Oct 2025 22:45:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2025100419-CVE-2022-50497-0aee@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2022-50497 https://www.cve.org/CVERecord?id=CVE-2022-50497
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Mon, 06 Oct 2025 14:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux Linux linux Kernel
Vendors & Products		Linux Linux linux Kernel

Sat, 04 Oct 2025 16:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: fix shift-out-of-bounds in check_special_flags UBSAN reported a shift-out-of-bounds warning: left shift of 1 by 31 places cannot be represented in type 'int' Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x8d/0xcf lib/dump_stack.c:106 ubsan_epilogue+0xa/0x44 lib/ubsan.c:151 __ubsan_handle_shift_out_of_bounds+0x1e7/0x208 lib/ubsan.c:322 check_special_flags fs/binfmt_misc.c:241 [inline] create_entry fs/binfmt_misc.c:456 [inline] bm_register_write+0x9d3/0xa20 fs/binfmt_misc.c:654 vfs_write+0x11e/0x580 fs/read_write.c:582 ksys_write+0xcf/0x120 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x34/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x4194e1 Since the type of Node's flags is unsigned long, we should define these macros with same type too.
Title		binfmt_misc: fix shift-out-of-bounds in check_special_flags
References		https://git.kernel.org/stable/c/0f1a48994b3e516d5c7fd5d12204fdba7a604771 https://git.kernel.org/stable/c/419b808504c26b3e3342365f34ccd0843e09a7f8 https://git.kernel.org/stable/c/6a46bf558803dd2b959ca7435a5c143efe837217 https://git.kernel.org/stable/c/88cea1676a09f7c45a1438153a126610c33b1590 https://git.kernel.org/stable/c/97382a2639b1cd9631f6069061e9d7062cd2b098 https://git.kernel.org/stable/c/a651bb5ff997b9f02662bcdef3d8b4e6f0d79656 https://git.kernel.org/stable/c/a91123d4bda463469f68f0427adabf8108001f94 https://git.kernel.org/stable/c/dcbc51d31d0afbd45e830e3cf565a7b3ca7bf0d8 https://git.kernel.org/stable/c/ea6145370be8016755c43aca799815fc4b8c88b1

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-10-04T15:43:48.656Z

Updated: 2026-05-11T19:20:35.762Z

Reserved: 2025-10-04T15:39:19.464Z

Link: CVE-2022-50497

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2025-10-04T16:15:46.777

Modified: 2026-01-22T19:57:33.957

Link: CVE-2022-50497

Redhat

Severity : Important

Publid Date: 2025-10-04T00:00:00Z

Links: CVE-2022-50497 - Bugzilla

OpenCVE Enrichment

Updated: 2025-10-06T14:41:29Z

Weaknesses

CWE-125

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object