CVE-2022-49950 – A memory corruption vulnerability in the Linux ... (How to Fix)

Q: What is the severity of CVE-2022-49950?

CVE-2022-49950 has a CVSS score of 7.8 (HIGH). A memory corruption vulnerability in the Linux kernel's fastrpc driver allows local attackers to corrupt kernel memory by opening a fastrpc device when session limits are exceeded. This affects Linux systems with the fastrpc driver loaded, typically on Qualcomm-based devices.

📋 TL;DR

A memory corruption vulnerability in the Linux kernel's fastrpc driver allows local attackers to corrupt kernel memory by opening a fastrpc device when session limits are exceeded. This affects Linux systems with the fastrpc driver loaded, typically on Qualcomm-based devices.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions with vulnerable fastrpc driver (specific versions not specified in CVE, but patches available for multiple stable branches)

Operating Systems: Linux distributions with vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires fastrpc driver to be loaded/available. Most common on Qualcomm-based systems/SoCs.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to root, kernel panic causing system crash, or arbitrary code execution in kernel context leading to complete system compromise.

🟠

Likely Case

Local privilege escalation allowing an unprivileged user to gain root access on the affected system.

🟢

If Mitigated

Limited to denial of service (kernel panic) if exploit attempts fail or are detected by security controls.

🌐 Internet-Facing: LOW - This is a local-only vulnerability requiring access to the system.

🏢 Internal Only: HIGH - Any local user or compromised service account could exploit this to gain root privileges.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to open fastrpc device. No public exploit code identified in references.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with fixes (see git references in CVE)

Vendor Advisory: https://git.kernel.org/stable/c/5cf2a57c7a01a0d7bdecf875a63682f542891b1b

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version. 2. Reboot system. 3. Verify kernel version matches patched release.

🔧 Temporary Workarounds

Disable fastrpc module

linux

Prevent loading of vulnerable fastrpc driver if not required

echo 'blacklist fastrpc' >> /etc/modprobe.d/blacklist.conf
rmmod fastrpc

🧯 If You Can't Patch

Restrict local user access to prevent exploitation
Implement strict SELinux/AppArmor policies to limit device access

🔍 How to Verify

Check if Vulnerable:

Check if fastrpc module is loaded: lsmod | grep fastrpc

Check Version:

uname -r

Verify Fix Applied:

Check kernel version against patched releases and verify fastrpc module version if available

📡 Detection & Monitoring

Log Indicators:

Kernel oops/panic messages
Failed fastrpc session allocations in kernel logs

Network Indicators:

None - local-only vulnerability

SIEM Query:

Search for: 'fastrpc' AND ('panic' OR 'oops' OR 'corruption') in kernel logs

📊 Metadata

CVE ID: CVE-2022-49950

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-787

EPSS Score: 0.02% exploit probability (4.7th percentile)

Published: June 18, 2025

Last Updated: December 31, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-49950, you might also want to check these: