Security readout for executives and security teams
Plain-English summary
This CVE describes a Linux kernel bug in the Qualcomm Venus video codec driver. During driver startup, power-management configuration is applied in the wrong order, triggering a kernel warning and causing the qcom-venus probe to fail. The public record does not provide CVSS, CWE, exploit details, or evidence of active exploitation.
Executive priority
Handle through normal kernel maintenance unless Qualcomm video-codec availability is business-critical. There is no cited active exploitation or severity score, but affected devices may lose Venus video codec functionality until patched.
Technical view
The issue is in Linux kernel Venus pm_helpers and OPP setup. The OPP core expects configuration options before the OPP table is added; the vulnerable code violates that ordering during probe. The fix reorders the OPP-related code. Evidence describes a WARN in dev_pm_opp_set_config and probe failure with error -16.
Likely exposure
Exposure appears limited to Linux systems running affected kernel versions with the Qualcomm Venus video codec driver path in use. The source mentions Qualcomm Robotics RB5 hardware, but does not prove all Qualcomm platforms are affected. Systems without this driver or hardware path are less likely to be exposed.
Exploitation context
No source in the bundle reports exploitation, public weaponization, or KEV listing. The described impact is a kernel warning and Venus driver probe failure during module initialization. Treat exploitation potential as unproven from the available evidence.
Researcher notes
The public record is sparse and operationally focused. Useful validation centers on kernel version, Venus driver use, OPP probe behavior, and presence of the stable commits. Do not infer privilege escalation, remote attack surface, or broader Qualcomm impact from the provided text alone.
Mitigation direction
- Update to a Linux kernel or vendor build containing the referenced stable fixes.
- Check distribution or device-vendor advisories for backported kernel packages.
- Prioritize systems using Qualcomm Venus video codec functionality.
- Test video-codec workloads after applying the kernel update.
Validation and detection
- Inventory Linux kernel versions on Qualcomm-based devices.
- Confirm whether the qcom-venus or venus_core driver is present and used.
- Review boot logs for OPP WARN messages and qcom-venus probe failure.
- Compare deployed kernel source or package changelog against the referenced commits.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50011 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0bdec5eed69c73886af4cfbb94b663e1e10b8344CVE reference, Linux
- https://git.kernel.org/stable/c/8d4eccd78461c3e3555bff67148432bb6c21d059CVE reference, Linux
- https://git.kernel.org/stable/c/1d95af02f23031c2e1cca7607c514b86ce85bc6eCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.