LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50075: tracing/eprobes: Have event probes be consistent with kprobes and uprobes

In the Linux kernel, the following vulnerability has been resolved: tracing/eprobes: Have event probes be consistent with kprobes and uprobes Currently, if a symbol "@" is attempted to be used with an event probe (eprobes), it will cause a NULL pointer dereference crash. Both kprobes and uprobes can reference data other than the main registers. Such as immediate address, symbols and the current task name. Have eprobes do the same thing. For "comm", if "comm" is used and the event being attached to does not have the "comm" field, then make it the "$comm" that kprobes has. This is consistent to the way histograms and filters work.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can crash a system when event probes handle a symbol-style reference incorrectly. The public record describes a NULL pointer dereference in tracing/eprobes. No CVSS score, CWE, or active exploitation evidence is provided, so urgency depends on whether affected kernels and tracing features are present.

Executive priority

Treat as a targeted availability risk for Linux infrastructure rather than a confirmed widespread emergency. Prioritize kernel inventory and vendor patch confirmation, especially on shared systems where tracing access might be broader than expected.

Technical view

The flaw is in Linux kernel tracing/eprobes consistency handling. Attempting to use a symbol "@" with an event probe can trigger a NULL pointer dereference crash. The fix aligns eprobe behavior with kprobes and uprobes, including handling for symbol references and "comm" field behavior.

Likely exposure

Exposure appears limited to Linux systems running affected kernel versions with event probe functionality available. The source bundle lists Linux 5.15 and fixed ranges including 5.15.63, 5.19.4, and 6.0, but does not clarify privilege requirements or distribution backports.

Exploitation context

The CVE record does not report active exploitation, and KEV is false. The described impact is a kernel crash from malformed eprobe use, but the sources do not establish remote reachability, privilege level needed, or exploit reliability.

Researcher notes

The public data is sparse: no CVSS, CWE, or privilege context is provided. Analysis should focus on mapping upstream stable commits to distribution kernels and determining who can configure eprobes in the local environment.

Mitigation direction

  • Identify Linux kernel versions deployed across servers, appliances, and container hosts.
  • Check distribution vendor advisories for backported fixes for CVE-2022-50075.
  • Upgrade affected kernels to a vendor-fixed release where available.
  • Restrict access to kernel tracing interfaces to trusted administrators.
  • Monitor hosts for unexpected kernel crashes involving tracing or eprobes.

Validation and detection

  • Confirm whether deployed kernels fall within affected versions or vendor-fixed builds.
  • Review vendor kernel changelogs for the referenced upstream stable commits.
  • Verify tracing/eprobe interfaces are not exposed to untrusted users.
  • Check crash logs for NULL pointer dereferences related to tracing/eprobes.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50075 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux7491e2c442781a1860181adb5ab472a52075f393, 7491e2c442781a1860181adb5ab472a52075f393, 7491e2c442781a1860181adb5ab472a52075f393unaffected
LinuxLinux5.15, 0, 5.15.63, 5.19.4, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.