ghsa-qw5g-ghj8-55p6
Vulnerability from github
In the Linux kernel, the following vulnerability has been resolved:
bpf: Prevent decl_tag from being referenced in func_proto arg
Syzkaller managed to hit another decl_tag issue:
btf_func_proto_check kernel/bpf/btf.c:4506 [inline] btf_check_all_types kernel/bpf/btf.c:4734 [inline] btf_parse_type_sec+0x1175/0x1980 kernel/bpf/btf.c:4763 btf_parse kernel/bpf/btf.c:5042 [inline] btf_new_fd+0x65a/0xb00 kernel/bpf/btf.c:6709 bpf_btf_load+0x6f/0x90 kernel/bpf/syscall.c:4342 __sys_bpf+0x50a/0x6c0 kernel/bpf/syscall.c:5034 __do_sys_bpf kernel/bpf/syscall.c:5093 [inline] __se_sys_bpf kernel/bpf/syscall.c:5091 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5091 do_syscall_64+0x54/0x70 arch/x86/entry/common.c:48
This seems similar to commit ea68376c8bed ("bpf: prevent decl_tag from being referenced in func_proto") but for the argument.
{
"affected": [],
"aliases": [
"CVE-2022-50883"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-30T13:16:03Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Prevent decl_tag from being referenced in func_proto arg\n\nSyzkaller managed to hit another decl_tag issue:\n\n btf_func_proto_check kernel/bpf/btf.c:4506 [inline]\n btf_check_all_types kernel/bpf/btf.c:4734 [inline]\n btf_parse_type_sec+0x1175/0x1980 kernel/bpf/btf.c:4763\n btf_parse kernel/bpf/btf.c:5042 [inline]\n btf_new_fd+0x65a/0xb00 kernel/bpf/btf.c:6709\n bpf_btf_load+0x6f/0x90 kernel/bpf/syscall.c:4342\n __sys_bpf+0x50a/0x6c0 kernel/bpf/syscall.c:5034\n __do_sys_bpf kernel/bpf/syscall.c:5093 [inline]\n __se_sys_bpf kernel/bpf/syscall.c:5091 [inline]\n __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5091\n do_syscall_64+0x54/0x70 arch/x86/entry/common.c:48\n\nThis seems similar to commit ea68376c8bed (\"bpf: prevent decl_tag from being\nreferenced in func_proto\") but for the argument.",
"id": "GHSA-qw5g-ghj8-55p6",
"modified": "2025-12-30T15:30:29Z",
"published": "2025-12-30T15:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50883"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/329a76635548ee8fceb3b78c7d54d96524e80925"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3f3d54962a032581996edda8e6bcbf7a30371234"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/89357aa97b521fca76e39d81e2b1ac5edb3d0b96"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b327c68ace71ba9cb3105ae6a5955a229e9bdca3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e6d276dcc9204f95632580c43d66c52ca502d7ec"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f17472d4599697d701aa239b4c475a506bccfd19"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.