LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50276: power: supply: fix null pointer dereferencing in power_supply_get_battery_info

In the Linux kernel, the following vulnerability has been resolved: power: supply: fix null pointer dereferencing in power_supply_get_battery_info when kmalloc() fail to allocate memory in kasprintf(), propname will be NULL, strcmp() called by of_get_property() will cause null pointer dereference. So return ENOMEM if kasprintf() return NULL pointer.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2022-50276 is a Linux kernel reliability flaw in the power supply subsystem. If memory allocation fails while reading battery information, the kernel can dereference a null pointer. The sources do not provide CVSS, impact details, or evidence of exploitation.

Executive priority

Treat this as a kernel maintenance item unless your environment relies heavily on affected Linux battery or power-supply paths. There is no cited active exploitation or CVSS score, so urgency depends on vendor advisories and exposure inventory.

Technical view

The flaw is in power_supply_get_battery_info. A failed kasprintf allocation can leave propname NULL, and of_get_property can call strcmp on that NULL value, causing a null pointer dereference. The kernel fix returns ENOMEM when kasprintf returns NULL.

Likely exposure

Exposure is limited to Linux systems running source-identified affected kernel versions where the relevant power supply or battery information path is reachable. The provided data names Linux only and does not identify specific distributions, devices, or vendors beyond Linux.

Exploitation context

The source bundle says this is not in KEV and provides no public exploitation evidence. The likely consequence from the description is kernel failure or denial of service, but the sources do not confirm practical exploitability, privileges required, or attack vector.

Researcher notes

Evidence is sparse. The bug is a defensive error-handling fix for allocation failure, not a described privilege escalation or remote vector. Validate exact affected and fixed ranges against upstream stable commits and distribution backports before assigning operational severity.

Mitigation direction

  • Check Linux vendor or distribution advisories for CVE-2022-50276.
  • Update to a kernel package containing the referenced stable fix commits.
  • Prioritize systems using battery or power supply kernel drivers.
  • Track affected kernel versions in asset and patch management records.
  • Avoid custom kernel backports unless they include the ENOMEM handling fix.

Validation and detection

  • Inventory Linux kernel versions across servers, endpoints, and embedded devices.
  • Review package changelogs for CVE-2022-50276 or referenced commit IDs.
  • Confirm the deployed kernel contains the power_supply_get_battery_info fix.
  • Identify systems using power supply or battery information drivers.
  • Monitor vendor advisories for corrected affected-version ranges.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50276 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux3afb50d7125bcdbf71df843134e96ceffc78c8b8, 3afb50d7125bcdbf71df843134e96ceffc78c8b8, 3afb50d7125bcdbf71df843134e96ceffc78c8b8, 3afb50d7125bcdbf71df843134e96ceffc78c8b8, 3afb50d7125bcdbf71df843134e96ceffc78c8b8, 3afb50d7125bcdbf71df843134e96ceffc78c8b8unaffected
LinuxLinux5.0, 0, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, 6.2affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.