LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50230: arm64: set UXN on swapper page tables

In the Linux kernel, the following vulnerability has been resolved: arm64: set UXN on swapper page tables [ This issue was fixed upstream by accident in c3cee924bd85 ("arm64: head: cover entire kernel image in initial ID map") as part of a large refactoring of the arm64 boot flow. This simple fix is therefore preferred for -stable backporting ] On a system that implements FEAT_EPAN, read/write access to the idmap is denied because UXN is not set on the swapper PTEs. As a result, idmap_kpti_install_ng_mappings panics the kernel when accessing __idmap_kpti_flag. Fix it by setting UXN on these PTEs.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-50230 is a Linux kernel issue affecting some arm64 systems. On hardware implementing FEAT_EPAN, missing UXN protection on swapper page tables can cause a kernel panic. The main business risk is availability loss on affected ARM64 Linux systems, not confirmed data theft or remote compromise.

Executive priority

Treat as a targeted availability risk for ARM64 Linux fleets. Prioritize patch validation where ARM64 systems support business-critical services. Broader enterprise urgency is lower unless such systems are deployed at scale.

Technical view

The Linux arm64 code did not set UXN on swapper PTEs. With FEAT_EPAN, read/write access to the idmap is denied, causing idmap_kpti_install_ng_mappings to panic when accessing __idmap_kpti_flag. Sources state it was fixed upstream accidentally by commit c3cee924 and separately by stable backport commit 9283e708.

Likely exposure

Exposure appears limited to Linux arm64 systems on affected kernel versions and hardware implementing FEAT_EPAN. The provided affected data indicates Linux 5.13 through before 5.19.1, but version metadata is incomplete and should be verified against vendor kernels.

Exploitation context

No CISA KEV listing or cited source indicates active exploitation. The described failure mode is a kernel panic during specific arm64 memory-management handling. Public sources do not describe a remote attack path or privilege escalation.

Researcher notes

Evidence is limited to the CVE record and Linux stable commits. No CVSS, CWE, exploit status, or detailed affected distribution list is provided. The technical fix is setting UXN on swapper PTEs for arm64.

Mitigation direction

  • Update affected ARM64 Linux kernels to a vendor release containing the referenced stable fix.
  • Check distribution advisories for backported fixes matching commits 9283e708 or c3cee924.
  • Prioritize systems using ARM64 hardware with FEAT_EPAN support.
  • Test kernel updates in staging before production rollout.

Validation and detection

  • Inventory ARM64 Linux systems and running kernel versions.
  • Confirm whether vendor kernel changelogs include the referenced fix commits.
  • Review crash logs for idmap_kpti_install_ng_mappings or __idmap_kpti_flag panics.
  • After updating, verify the running kernel is the intended fixed build.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50230 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux18107f8a2df6bf1c6cac8d0713f757f866d5af51, 18107f8a2df6bf1c6cac8d0713f757f866d5af51unaffected
LinuxLinux5.13, 0, 5.19.1, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.