{"id":"DEBIAN-CVE-2022-50531","details":"In the Linux kernel, the following vulnerability has been resolved:  tipc: fix an information leak in tipc_topsrv_kern_subscr  Use a 8-byte write to initialize sub.usr_handle in tipc_topsrv_kern_subscr(), otherwise four bytes remain uninitialized when issuing setsockopt(..., SOL_TIPC, ...). This resulted in an infoleak reported by KMSAN when the packet was received:    =====================================================   BUG: KMSAN: kernel-infoleak in copyout+0xbc/0x100 lib/iov_iter.c:169    instrument_copy_to_user ./include/linux/instrumented.h:121    copyout+0xbc/0x100 lib/iov_iter.c:169    _copy_to_iter+0x5c0/0x20a0 lib/iov_iter.c:527    copy_to_iter ./include/linux/uio.h:176    simple_copy_to_iter+0x64/0xa0 net/core/datagram.c:513    __skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:419    skb_copy_datagram_iter+0x58/0x200 net/core/datagram.c:527    skb_copy_datagram_msg ./include/linux/skbuff.h:3903    packet_recvmsg+0x521/0x1e70 net/packet/af_packet.c:3469    ____sys_recvmsg+0x2c4/0x810 net/socket.c:?    ___sys_recvmsg+0x217/0x840 net/socket.c:2743    __sys_recvmsg net/socket.c:2773    __do_sys_recvmsg net/socket.c:2783    __se_sys_recvmsg net/socket.c:2780    __x64_sys_recvmsg+0x364/0x540 net/socket.c:2780    do_syscall_x64 arch/x86/entry/common.c:50    do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80    entry_SYSCALL_64_after_hwframe+0x63/0xcd arch/x86/entry/entry_64.S:120    ...    Uninit was stored to memory at:    tipc_sub_subscribe+0x42d/0xb50 net/tipc/subscr.c:156    tipc_conn_rcv_sub+0x246/0x620 net/tipc/topsrv.c:375    tipc_topsrv_kern_subscr+0x2e8/0x400 net/tipc/topsrv.c:579    tipc_group_create+0x4e7/0x7d0 net/tipc/group.c:190    tipc_sk_join+0x2a8/0x770 net/tipc/socket.c:3084    tipc_setsockopt+0xae5/0xe40 net/tipc/socket.c:3201    __sys_setsockopt+0x87f/0xdc0 net/socket.c:2252    __do_sys_setsockopt net/socket.c:2263    __se_sys_setsockopt net/socket.c:2260    __x64_sys_setsockopt+0xe0/0x160 net/socket.c:2260    do_syscall_x64 arch/x86/entry/common.c:50    do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80    entry_SYSCALL_64_after_hwframe+0x63/0xcd arch/x86/entry/entry_64.S:120    Local variable sub created at:    tipc_topsrv_kern_subscr+0x57/0x400 net/tipc/topsrv.c:562    tipc_group_create+0x4e7/0x7d0 net/tipc/group.c:190    Bytes 84-87 of 88 are uninitialized   Memory access of size 88 starts at ffff88801ed57cd0   Data copied to user address 0000000020000400   ...   =====================================================","modified":"2026-09-01T16:05:35.527347191Z","published":"2025-10-07T16:15:37.143Z","upstream":["CVE-2022-50531"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2022-50531"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.6-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50531.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.6-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50531.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.6-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50531.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}