CVE-2022-50749 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
acct: fix potential integer overflow in encode_comp_t()
The integer overflow is descripted with following codes: > 317 static comp_t encode_comp_t(u64 value) > 318 {
> 319 int exp, rnd; ...... > 341 exp <<= MANTSIZE; > 342 exp += value; > 343 return exp; > 344 }
Currently comp_t is defined as type of '__u16', but the variable 'exp' is type of 'int', so overflow would happen when variable 'exp' in line 343 is greater than 65535.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/21/2026
The vulnerability identified as CVE-2022-50749 represents a critical integer overflow condition within the Linux kernel's accounting subsystem, specifically in the encode_comp_t() function located in the kernel's accounting implementation. This flaw exists in the way the kernel handles process accounting data, where the function attempts to encode computational values into a 16-bit unsigned integer type known as comp_t. The vulnerability stems from a fundamental type mismatch where the intermediate calculation variable exp is declared as a 32-bit integer while the final result must fit within a 16-bit container, creating a potential overflow scenario that could compromise system integrity.
The technical flaw manifests in the mathematical operations performed within the encode_comp_t function where the variable exp undergoes left bit shifting operations followed by addition operations that ultimately exceed the maximum value that can be represented by a 16-bit unsigned integer. When the expression exp <<= MANTSIZE; followed by exp += value; results in a value greater than 65535, the 16-bit constraint of comp_t causes the overflow to occur, leading to unpredictable behavior in the accounting system. This type of integer overflow is classified under CWE-190 as an integer overflow or wraparound, which is a well-documented weakness that can lead to various security implications including memory corruption and potential privilege escalation.
The operational impact of this vulnerability extends beyond simple accounting data corruption, as the accounting subsystem in Linux kernel is fundamental to system monitoring and resource tracking mechanisms. An attacker who can manipulate the conditions leading to this overflow might potentially exploit the resulting corrupted data to cause system instability or gain unauthorized access to system resources. The vulnerability particularly affects systems that rely heavily on process accounting for monitoring, auditing, or resource management purposes, making it a significant concern for enterprise environments where such accounting data is critical for security operations. The flaw represents a direct threat to system integrity and could potentially enable attackers to bypass security controls that depend on accurate accounting information.
Mitigation strategies for CVE-2022-50749 should focus on patching the kernel to address the integer overflow condition by ensuring proper bounds checking and type handling within the encode_comp_t function. System administrators should prioritize updating their kernel versions to include the fix that properly validates the intermediate calculations before storing results in the 16-bit comp_t container. Additionally, monitoring systems should be enhanced to detect anomalous accounting data patterns that might indicate exploitation attempts. From an ATT&CK framework perspective, this vulnerability could be leveraged as part of a broader attack chain targeting system stability and resource management, potentially enabling techniques such as privilege escalation or denial of service attacks. Organizations should implement comprehensive patch management processes and consider deploying kernel hardening measures to reduce the attack surface associated with such low-level system components.