Security readout for executives and security teams
Plain-English summary
CVE-2022-50369 is a Linux kernel crash bug in the VKMS graphics driver. Under an out-of-memory error path during module initialization, the kernel can try to destroy a workqueue that was never created, causing a null pointer dereference. The main business impact is local denial of service, not data theft or remote compromise.
Executive priority
Treat as a routine kernel availability fix unless VKMS is used on multi-user or lab systems where local crash risk matters. It does not indicate remote compromise or data exposure in the provided evidence.
Technical view
The flaw is CWE-476 in drm/vkms vkms_release(). If devm_add_action() fails before vkms_crtc_init() allocates output.composer_workq, cleanup can call destroy_workqueue() on NULL. The listed fix checks composer_workq before destroying it. CVSS is 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Likely exposure
Exposure is limited to Linux systems running affected kernel versions where the VKMS driver is present and reachable by a local privileged or low-privileged context as modeled by CVSS. Internet-facing exposure is not indicated by the provided sources.
Exploitation context
The source bundle shows no CISA KEV listing and provides no evidence of active exploitation. The described trigger is a local kernel initialization cleanup path under out-of-memory conditions while loading VKMS, so exploitation context appears operationally narrow.
Researcher notes
Focus analysis on drm/vkms cleanup ordering and the OOM failure path before workqueue allocation. Evidence supports null pointer dereference and availability impact only. The bundle does not establish exploit maturity, distribution package names, or broad product impact beyond Linux kernel versions.
Mitigation direction
- Apply kernel updates containing the referenced VKMS NULL-check fix.
- Check Linux distribution advisories for fixed packages for affected kernel lines.
- Prioritize shared systems where local users can influence module loading paths.
- Reboot into the fixed kernel when required by vendor update guidance.
Validation and detection
- Inventory Linux kernel versions across affected assets.
- Check whether the VKMS driver is present, enabled, or loadable.
- Map running kernels against the affected versions and stable commit references.
- Confirm patched source includes a NULL check before destroy_workqueue().
- Review kernel logs for VKMS-related oops events during module load.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-50369 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0b8f390e2251191f1b179cc87f65d54c96565f0dCVE reference
- https://git.kernel.org/stable/c/1f9836f95271e7acf016667eee0aeae3386f9645CVE reference
- https://git.kernel.org/stable/c/596f1ba3987e601e31a5abf1f75ce1d2635aceacCVE reference
- https://git.kernel.org/stable/c/57031c474c3a920ea73afeb5dc352e537f5793eeCVE reference
- https://git.kernel.org/stable/c/2fe2a8f40c21161ffe7653cc234e7934db5b7cc5CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.