LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50272: media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()

In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() Wei Chen reports a kernel bug as blew: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] ... Call Trace: <TASK> __i2c_transfer+0x77e/0x1930 drivers/i2c/i2c-core-base.c:2109 i2c_transfer+0x1d5/0x3d0 drivers/i2c/i2c-core-base.c:2170 i2cdev_ioctl_rdwr+0x393/0x660 drivers/i2c/i2c-dev.c:297 i2cdev_ioctl+0x75d/0x9f0 drivers/i2c/i2c-dev.c:458 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fd834a8bded In az6027_i2c_xfer(), if msg[i].addr is 0x99, a null-ptr-deref will caused when accessing msg[i].buf. For msg[i].len is 0 and msg[i].buf is null. Fix this by checking msg[i].len in az6027_i2c_xfer().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel bug in the AZ6027 DVB-USB media driver. Under a specific malformed I2C transfer condition, the kernel can dereference a null pointer and crash. The supplied sources do not show data theft, privilege escalation, or active exploitation.

Executive priority

Treat as routine patching unless affected hardware and local untrusted access are present. The main business risk is system availability disruption, not confirmed compromise. Include it in kernel maintenance rather than emergency response unless vendor guidance raises severity.

Technical view

The flaw is in az6027_i2c_xfer(). If an I2C message uses address 0x99 with length 0 and a null buffer, the driver accesses msg[i].buf and triggers a null-pointer dereference. Kernel stable commits fix this by checking msg[i].len before access.

Likely exposure

Exposure appears limited to Linux systems with the affected AZ6027 DVB-USB driver code present and reachable, especially where users or software can issue I2C device ioctls. Systems without this hardware, driver, or device access are less likely to be exposed.

Exploitation context

The source bundle reports a crash trace and marks KEV as false. No cited source states active exploitation. Based on the trace, practical impact is most likely local denial of service through a kernel fault, but access requirements are not fully specified.

Researcher notes

Evidence supports a null-pointer dereference in a specific driver path, fixed by a length check. The supplied affected-version data is incomplete or flattened, so branch-specific exposure should be confirmed through kernel vendor advisories and commit presence rather than version strings alone.

Mitigation direction

  • Update to a Linux kernel containing the cited stable fix for your branch.
  • Check your distribution vendor advisory for exact fixed package versions.
  • Disable or avoid loading the AZ6027 DVB-USB driver if unused.
  • Restrict access to I2C device nodes to trusted users only.
  • Prioritize higher where untrusted local users can access affected devices.

Validation and detection

  • Inventory Linux kernels and identify systems using the AZ6027 DVB-USB driver.
  • Check whether vendor kernel packages include one of the cited stable commits.
  • Review device permissions for I2C and DVB-related device nodes.
  • Confirm whether affected hardware or module loading is present on exposed hosts.
  • Record compensating controls if patching is delayed.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50272 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
10Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux76f9a820c8672ada12ffa0903652c9e6f2429462, 76f9a820c8672ada12ffa0903652c9e6f2429462, 76f9a820c8672ada12ffa0903652c9e6f2429462, 76f9a820c8672ada12ffa0903652c9e6f2429462, 76f9a820c8672ada12ffa0903652c9e6f2429462, 76f9a820c8672ada12ffa0903652c9e6f2429462, 76f9a820c8672ada12ffa0903652c9e6f2429462, 76f9a820c8672ada12ffa0903652c9e6f2429462, 76f9a820c8672ada12ffa0903652c9e6f2429462unaffected
LinuxLinux2.6.34, 0, 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, 6.2affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.