CVE-2022-50093 – This vulnerability in the Linux kernel's Intel ... (How to Fix)

Q: What is the severity of CVE-2022-50093?

CVE-2022-50093 has a CVSS score of 7.1 (HIGH). This vulnerability in the Linux kernel's Intel IOMMU driver allows invalid memory access when ACPI NUMA is disabled. It can cause kernel crashes or potential privilege escalation by reading/writing arbitrary kernel memory. Affects Linux systems with Intel processors using the IOMMU driver.

📋 TL;DR

This vulnerability in the Linux kernel's Intel IOMMU driver allows invalid memory access when ACPI NUMA is disabled. It can cause kernel crashes or potential privilege escalation by reading/writing arbitrary kernel memory. Affects Linux systems with Intel processors using the IOMMU driver.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions before fixes were applied (specific versions vary by distribution)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when ACPI NUMA is disabled via kernel command line (e.g., 'numa=off') and using Intel IOMMU driver.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, or potential privilege escalation allowing attackers to execute arbitrary code in kernel context.

🟠

Likely Case

System instability, kernel crashes, or denial of service when the vulnerable code path is triggered.

🟢

If Mitigated

System remains stable with proper patching; unpatched systems may experience crashes under specific configurations.

🌐 Internet-Facing: LOW - Requires local access or ability to trigger specific kernel code paths.

🏢 Internal Only: MEDIUM - Local attackers could potentially exploit this for privilege escalation or DoS attacks.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires triggering specific kernel code paths and may be challenging to weaponize reliably.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Various kernel versions with commit 0b4c0003aeda32a600f95df53b2848da8a5aa3fa or later

Vendor Advisory: https://git.kernel.org/stable/c/0b4c0003aeda32a600f95df53b2848da8a5aa3fa

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution. 2. For custom kernels, apply commit 0b4c0003aeda32a600f95df53b2848da8a5aa3fa. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Enable ACPI NUMA

linux

Ensure ACPI NUMA is not disabled via kernel command line

Remove 'numa=off' from kernel boot parameters in /etc/default/grub or bootloader config

🧯 If You Can't Patch

Ensure ACPI NUMA is enabled (remove 'numa=off' from kernel parameters)
Restrict local user access to prevent potential privilege escalation attempts

🔍 How to Verify

Check if Vulnerable:

Check kernel version and boot parameters: 'uname -r' and 'cat /proc/cmdline' for 'numa=off'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is patched and check that 'numa=off' is not present in boot parameters

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
KASAN reports of wild-memory-access in dmar_parse_one_rhsa
System crashes during boot with NUMA disabled

Network Indicators:

None - local vulnerability only

SIEM Query:

Search for kernel logs containing 'KASAN: wild-memory-access' or 'dmar_parse_one_rhsa'

📊 Metadata

CVE ID: CVE-2022-50093

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE: CWE-125

EPSS Score: 0.01% exploit probability (2th percentile)

Published: June 18, 2025

Last Updated: November 18, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-50093, you might also want to check these: