{"cve":"CVE-2022-50859","nvd":{"published":"2025-12-30T13:16:00.673","modified":"2026-06-17T05:24:18.583","status":"Deferred","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message\n\nCommit d5c7076b772a (\"smb3: add smb3.1.1 to default dialect list\")\nextend the dialects from 3 to 4, but forget to decrease the extended\nlength when specific the dialect, then the message length is larger\nthan expected.\n\nThis maybe leak some info through network because not initialize the\nmessage body.\n\nAfter apply this patch, the VALIDATE_NEGOTIATE_INFO message length is\nreduced from 28 bytes to 26 bytes.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/60480291c1fcafad8425d93f771b5bcc2bd398b4","https://git.kernel.org/stable/c/9312e04b6c6bc46354ecd0cc82052a2b3df0b529","https://git.kernel.org/stable/c/943eb0ede74ecd609fdfd3f0b83e0d237613e526","https://git.kernel.org/stable/c/d0050ec3ebbcb3451df9a65b8460be9b9e02e80c","https://git.kernel.org/stable/c/e98ecc6e94f4e6d21c06660b0f336df02836694f"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:18:08.089039631+00:00"},"epss":{"cve":"CVE-2022-50859","score":0.00244,"percentile":0.15705,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}