CVE-2022-50859

Not scored yetLast modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message

Commit d5c7076b772a ("smb3: add smb3.1.1 to default dialect list") extend the dialects from 3 to 4, but forget to decrease the extended length when specific the dialect, then the message length is larger than expected.

This maybe leak some info through network because not initialize the message body.

After apply this patch, the VALIDATE_NEGOTIATE_INFO message length is reduced from 28 bytes to 26 bytes.

Metrics

No CVSS score has been published yet.

Affected software

No affected versions have been published.

Timeline

Published
Dec 30, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2022

CVE-2022-508607.8In the Linux kernel, the following vulnerability has been resolved: apparmor: Fix memleak in alloc_ns() After changes in commit a1bd627b46CVE-2022-508617.5In the Linux kernel, the following vulnerability has been resolved: NFSD: Finish converting the NFSv2 GETACL result encoder The xdr_streamCVE-2022-50862In the Linux kernel, the following vulnerability has been resolved: bpf: prevent decl_tag from being referenced in func_proto Syzkaller waCVE-2022-50863In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: free unused skb to prevent memory leak This avoid potentiCVE-2022-50864In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix shift-out-of-bounds due to too large exponent of block sizeCVE-2022-508657.5In the Linux kernel, the following vulnerability has been resolved: tcp: fix a signed-integer-overflow bug in tcp_add_backlog() The type oCVE-2022-50866In the Linux kernel, the following vulnerability has been resolved: ASoC: pxa: fix null-pointer dereference in filter() kasprintf() would CVE-2022-508677.8In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Fix kvzalloc vs state_kcalloc usage adreno_show_object()CVE-2022-50868In the Linux kernel, the following vulnerability has been resolved: hwrng: amd - Fix PCI device refcount leak for_each_pci_dev() is implemCVE-2022-508697.8In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix slab-out-of-bounds in r_page When PAGE_SIZE is 64K, if rCVE-2022-50870In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: avoid device tree lookups in rtas_os_term() rtas_os_termCVE-2022-508717.8In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Fix qmi_msg_handler data structure initialization qmi_ms
CVE-2022-50859: Unscored | Vulnix