CVE-2022-50407 Details
Description
In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - increase the memory of local variables Increase the buffer to prevent stack overflow by fuzz test. The maximum length of the qos configuration buffer is 256 bytes. Currently, the value of the 'val buffer' is only 32 bytes. The sscanf does not check the dest memory length. So the 'val buffer' may stack overflow.
A stack overflow vulnerability has been identified in the Linux kernel's Hisilicon QM crypto module. The issue arises because the 'val buffer' variable, which is used for QoS configuration, is only 32 bytes long. This length is insufficient, as the maximum QoS configuration buffer can be 256 bytes. The vulnerability is further exacerbated by the 'sscanf' function, which does not validate the length of the destination memory, allowing for potential stack overflow exploitation.
Users can upgrade to the patched version of the Linux kernel available in the Linux kernel stable tree.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/34c4f8ad45b4ea814c7ecc3f23a2d292959d5a52 | kernel.org | Patch |
| https://git.kernel.org/stable/c/3efe90af4c0c46c58dba1b306de142827153d9c0 | kernel.org | Patch |
| https://git.kernel.org/stable/c/fc521abb6ee4b8f06fdfc52646140dab6a2ed334 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
| CWE-674 | Uncontrolled Recursion | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.4, < 6.0.16 >= 6.1, < 6.1.2 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 15, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 14, 2026 | CVE Modified | CISA-ADP |
| Dec 11, 2025 | Initial Analysis | [email protected] |
| Sep 18, 2025 | New CVE Received | kernel.org |