LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50130: staging: fbtft: core: set smem_len before fb_deferred_io_init call

In the Linux kernel, the following vulnerability has been resolved: staging: fbtft: core: set smem_len before fb_deferred_io_init call The fbtft_framebuffer_alloc() calls fb_deferred_io_init() before initializing info->fix.smem_len. It is set to zero by the framebuffer_alloc() function. It will trigger a WARN_ON() at the start of fb_deferred_io_init() and the function will not do anything.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2022-50130 is a Linux kernel bug in the staging fbtft framebuffer driver. A field is initialized too late, causing deferred I/O setup to stop after a warning. Public sources do not show active exploitation or a quantified severity. Business urgency is mainly for systems using fbtft-based display drivers.

Executive priority

Treat as targeted, not enterprise-wide urgent, unless embedded or specialized Linux devices rely on fbtft displays. Patch through normal kernel maintenance after confirming exposure. Escalate only if affected display systems are safety-critical, highly available, or difficult to recover.

Technical view

In fbtft_framebuffer_alloc(), fb_deferred_io_init() is called before info->fix.smem_len is set. Because framebuffer_alloc() leaves smem_len as zero, fb_deferred_io_init() hits WARN_ON() and returns without initializing deferred I/O. The kernel stable commits reorder initialization to set smem_len first.

Likely exposure

Exposure appears limited to Linux systems using the staging fbtft framebuffer driver. The CVE record lists affected Linux kernel versions including 5.18.18, 5.19, 5.19.2, and 6.0. Distribution kernels may differ because of backports and configuration choices.

Exploitation context

No provided source reports active exploitation, public exploit use, or KEV listing. The described impact is an initialization failure with a kernel warning, not a documented remote attack path. Security impact remains unclear from the supplied sources.

Researcher notes

Evidence is sparse: no CVSS, CWE, exploit status, or detailed impact is provided. The issue is a kernel staging driver ordering bug fixed by stable commits. Validate against actual kernel configuration and downstream backports rather than version strings alone.

Mitigation direction

  • Check Linux distribution or vendor guidance for fixed kernel packages.
  • Update to a kernel containing the referenced stable fixes where applicable.
  • Prioritize systems using fbtft or framebuffer display support.
  • If fbtft is unused, consider disabling it per vendor-supported configuration guidance.

Validation and detection

  • Inventory Linux kernel versions across affected assets.
  • Check whether the fbtft staging driver is built, loaded, or required.
  • Verify whether vendor kernels include the referenced stable commits.
  • Review kernel logs for related fb_deferred_io_init WARN_ON events.
  • Confirm remediation through vendor advisory status or fixed package metadata.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50130 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe79b2b2aadeffe1db54a6b569b9b621575c3eb07, 6a9ae2fe887042f76fd3d334349e64e8ab3c55a2, 856082f021a28221db2c32bd0531614a8382be67, 856082f021a28221db2c32bd0531614a8382be67unaffected
LinuxLinux5.19, 0, 5.18.18, 5.19.2, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.