Security readout for executives and security teams
Plain-English summary
This is a Linux kernel stability and safety issue in Intel VT-d IOMMU handling. Under specific NUMA-related conditions, such as ACPI NUMA being disabled, the kernel can treat NUMA_NO_NODE (-1) as a bit number and read invalid memory. The bundle does not show remote exploitation, active exploitation, or CVSS severity.
Executive priority
Treat this as kernel maintenance with targeted urgency for infrastructure using affected Linux kernels and Intel VT-d. Without evidence of exploitation or a CVSS score, it should not displace actively exploited vulnerabilities, but unpatched kernel memory-safety issues should be removed from production baselines.
Technical view
dmar_parse_one_rhsa can call node_online() with NUMA_NO_NODE. node_online() reaches test_bit() without validating the node value, so -1 becomes ULONG_MAX and produces an invalid bitmap index. The fix adds an explicit NUMA_NO_NODE check before test_bit(); stated logic otherwise remains unchanged.
Likely exposure
Exposure appears limited to affected Linux kernel versions using the Intel VT-d IOMMU path and encountering the described NUMA mapping condition. Systems with ACPI NUMA disabled are specifically mentioned. The provided affected-version data is broad and should be verified against distribution kernel backports.
Exploitation context
The source bundle marks KEV as false and provides no cited evidence of active exploitation. The described trigger is a kernel boot or hardware/firmware configuration condition observed through KASAN, not a documented remote attack path.
Researcher notes
The record is clear on root cause and fix direction, but incomplete on impact, exploitability, and distribution-specific affected ranges. Avoid assuming confidentiality, privilege escalation, or remote impact from the supplied evidence alone. Focus validation on kernel lineage, NUMA configuration, and presence of the upstream stable patch.
Mitigation direction
- Inventory Linux kernels on Intel VT-d/IOMMU-capable systems.
- Apply vendor or stable-kernel updates containing the referenced fixes.
- Check Linux distribution advisories for backported status.
- Review boot parameters for ACPI NUMA-related settings on affected systems.
Validation and detection
- Confirm the running kernel includes the relevant stable fix commit or vendor backport.
- Review boot logs for KASAN or wild-memory-access reports in dmar_parse_one_rhsa.
- Validate affected hosts after kernel update with normal boot and IOMMU enabled.
- Track exceptions where distro kernels use backports instead of upstream version numbers.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit b12304984654d8e58a2b22ff94c4410906d6267f
- Linux stable commit 5659efdadf04b56707d58c1b758df16d2e0eff2c
- Linux stable commit 0b4c0003aeda32a600f95df53b2848da8a5aa3fa
- Linux stable commit 73ce2046e04ad488cecc66757c36cbe1bdf089d4
- Linux stable commit c2304c50f4d94f56c2e326f25c9dc8cf2ba6f5fa
- Linux stable commit b0b0b77ea611e3088e9523e60860f4f41b62b235
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50093 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b12304984654d8e58a2b22ff94c4410906d6267fCVE reference, Linux
- https://git.kernel.org/stable/c/5659efdadf04b56707d58c1b758df16d2e0eff2cCVE reference, Linux
- https://git.kernel.org/stable/c/0b4c0003aeda32a600f95df53b2848da8a5aa3faCVE reference, Linux
- https://git.kernel.org/stable/c/73ce2046e04ad488cecc66757c36cbe1bdf089d4CVE reference, Linux
- https://git.kernel.org/stable/c/c2304c50f4d94f56c2e326f25c9dc8cf2ba6f5faCVE reference, Linux
- https://git.kernel.org/stable/c/b0b0b77ea611e3088e9523e60860f4f41b62b235CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.