CVE-2022-50368 – This CVE describes a memory corruption vulnerab... (How to Fix)

Q: What is the severity of CVE-2022-50368?

CVE-2022-50368 has a CVSS score of 7.8 (HIGH). This CVE describes a memory corruption vulnerability in the Linux kernel's DRM/MSM DSI driver where missing bounds checking allows writing beyond a fixed-size bridge array when more than eight bridges are present. This could allow local attackers to crash the system or potentially execute arbitrary code. Affected systems are those running vulnerable Linux kernel versions with the MSM DSI driver enabled.

📋 TL;DR

This CVE describes a memory corruption vulnerability in the Linux kernel's DRM/MSM DSI driver where missing bounds checking allows writing beyond a fixed-size bridge array when more than eight bridges are present. This could allow local attackers to crash the system or potentially execute arbitrary code. Affected systems are those running vulnerable Linux kernel versions with the MSM DSI driver enabled.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in CVE, but patches exist for multiple stable branches.

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when MSM DSI driver is enabled (typically on Qualcomm/Adreno GPU systems).

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to kernel-level code execution, leading to complete system compromise.

🟠

Likely Case

Kernel panic or system crash causing denial of service.

🟢

If Mitigated

Limited impact if proper kernel hardening and privilege separation are in place.

🌐 Internet-Facing: LOW - Requires local access to exploit.

🏢 Internal Only: MEDIUM - Could be exploited by malicious local users or through other local attack vectors.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to trigger the DSI bridge condition. No public exploit code known.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with fixes: 21c4679af01f, 2e786eb2f9ce, 4e5587cddb33, 9f035d1fb306, e83b354890a3

Vendor Advisory: https://patchwork.freedesktop.org/patch/502668/

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version. 2. Rebuild kernel if compiling from source. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable MSM DSI driver

linux

Remove or disable the vulnerable driver module if not needed.

modprobe -r msm
echo 'blacklist msm' >> /etc/modprobe.d/blacklist.conf

🧯 If You Can't Patch

Restrict local user access to systems with vulnerable kernels
Implement strict kernel module loading policies

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if MSM DSI driver is loaded: 'lsmod | grep msm' and 'uname -r'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated and driver version includes the patch commit IDs

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages
System crashes/panics related to DSI or GPU drivers

Network Indicators:

None - local exploit only

SIEM Query:

Search for kernel panic logs or DSI driver failure messages

📊 Metadata

CVE ID: CVE-2022-50368

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-787

EPSS Score: 0.03% exploit probability (6.7th percentile)

Published: September 17, 2025

Last Updated: January 14, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-50368, you might also want to check these: