Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s AMD GPU driver can mishandle memory after an error, potentially allowing a low-privileged local user to crash the system or affect protected data. It requires local access and an exposed AMD GPU driver, so it is not a remote internet attack.
Executive priority
Treat this as a high patching priority for shared workstations, GPU hosts, and other systems granting AMD GPU access to untrusted users. For isolated single-user systems, include it in the normal expedited kernel-update cycle; available evidence does not justify declaring an active-exploitation emergency.
Technical view
On an error path, amdgpu_cs_vm_handling unlocks bo_list_mutex before amdgpu_cs_parser_fini unlocks it again. The resulting reference-count underflow can cause a use-after-free. The supplied CVSS 3.1 score is 7.8, with local, low-complexity, low-privilege access and possible confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely on systems running affected Linux 5.19-series kernels with the amdgpu driver and AMD GPU access available to local users or workloads. The bundle’s version data is insufficient to map every distribution kernel or backport reliably.
Exploitation context
The CVE is not listed as KEV in the supplied bundle, and no cited source establishes active exploitation. The documented trace demonstrates the defect through an AMD GPU ioctl path, but it does not establish reliable real-world exploitation or remote reachability.
Researcher notes
The failure is an error-path double unlock involving bo_list_mutex, followed by reference-count underflow and use-after-free. The supplied trace involves a Chrome GPU process, but that alone does not prove browser-based or remote exploitation. Exact affected and fixed downstream package versions require vendor confirmation.
Mitigation direction
- Install a supported vendor kernel containing the applicable Linux stable fix.
- Check distribution guidance because downstream kernels may backport fixes without matching upstream version numbers.
- Prioritize shared systems where untrusted local users or workloads can access AMD GPU devices.
- If patching is delayed, ask the vendor about supported methods to limit untrusted GPU access.
Validation and detection
- Inventory Linux kernel builds and identify systems using the amdgpu driver.
- Confirm affected systems against vendor advisories and package changelogs, including backported fixes.
- Verify the installed kernel contains the applicable referenced stable commit.
- Review kernel logs for amdgpu_cs_ioctl failures, refcount underflow, or use-after-free warnings.
- After updating, confirm systems boot successfully and AMD GPU workloads operate normally.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50035 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/1b38e3b423f0bb41ee6abae5ca9deec1546ba227CVE reference, Linux
- https://git.kernel.org/stable/c/bbca24d0a3c11193bafb9e174f89f52a379006e3CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.