Security readout for executives and security teams
Plain-English summary
A Linux kernel tracing bug can trigger a kernel NULL pointer dereference when event probes request unsupported stack or register data. The observed result is a kernel oops, which is primarily an availability risk. The sources do not show remote exploitation, privilege requirements, CVSS scoring, or active exploitation.
Executive priority
Treat as a targeted availability issue for Linux infrastructure rather than a broad remote compromise signal. Prioritize patching shared hosts, production systems with tracing enabled, and environments where untrusted users or workloads may access tracing features.
Technical view
Event probes do not use pt_regs, but parsing allowed $stack-style variables and % register references. Requesting instruction pointer data caused get_event_field() to dereference NULL during eprobe processing. The fix rejects unsupported $ variables and % register parsing for event probes.
Likely exposure
Exposure appears limited to Linux systems with affected kernel versions or commits where event probes are available and can be configured. The bundle lists Linux 5.15, 5.15.63, 5.19.4, and 6.0 indicators, but downstream distribution backport status must be verified.
Exploitation context
The source describes a local tracing experiment using trace-cmd that produced a kernel oops. There is no KEV listing and no cited evidence of active exploitation, public weaponization, remote attackability, or privilege requirements.
Researcher notes
The CVE evidence is narrow: a kernel crash from unsupported eprobe argument parsing and three stable commit references. CVSS, CWE, exploit maturity, and exact privilege boundary are not provided, so validation should focus on kernel lineage and tracing interface access.
Mitigation direction
- Map running kernels to vendor advisories and stable kernel fixes.
- Update to a kernel build containing the referenced stable fixes.
- Restrict access to kernel tracing interfaces where operationally feasible.
- Check distribution backports before assuming version numbers alone indicate exposure.
Validation and detection
- Inventory Linux kernel versions across servers, appliances, and containers hosts.
- Confirm whether tracefs/debugfs tracing interfaces are enabled or exposed.
- Review vendor kernel changelogs for the referenced stable commits.
- Verify patched systems no longer permit unsupported eprobe stack or register references.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50078 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ba53c21ce9773743b8e0a8ada048c96ff2d55c67CVE reference, Linux
- https://git.kernel.org/stable/c/7c262114a576d94c0ced80e232bbb17391a55908CVE reference, Linux
- https://git.kernel.org/stable/c/2673c60ee67e71f2ebe34386e62d348f71edee47CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.