Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s Panfrost graphics driver can let a low-privileged local user trigger use-after-free memory corruption. Successful exploitation could compromise data, system integrity, or availability. The issue is not remotely exploitable according to the supplied CVSS vector.
Executive priority
Treat as a high-priority local privilege-boundary issue on systems using Panfrost, especially where untrusted users can execute code. First confirm driver and kernel exposure because systems without the affected driver path are unlikely to be reachable. Remediate through supported kernel updates.
Technical view
Incorrect GEM buffer-object reference counting allowed userspace to release a guessed handle while the kernel still used the object. A related mapping-failure path could drop another reference. The correction moves handle creation into panfrost_ioctl_create_bo() and returns an error when the handle was already freed.
Likely exposure
Exposure requires an affected Linux kernel, the Panfrost driver, and local low-privileged access. The bundle lists 5.2, 5.10.163, 5.15.87, 6.0.19, 6.1.5, and 6.2 as affected, but provides incomplete version-range semantics; the listed “0” is ambiguous.
Exploitation context
The CVSS vector indicates local access, low complexity, low privileges, and no user interaction, with potentially high confidentiality, integrity, and availability impact. The bundle marks KEV false and provides no evidence of active exploitation or a public exploit. KEV absence does not prove exploitation has never occurred.
Researcher notes
CWE-416 and the description support a use-after-free classification caused by GEM handle ownership and reference-counting errors. Exact affected and fixed release boundaries are not fully represented in the bundle. The five stable-kernel commits are the strongest supplied indicators for backport verification; exploitability has not been independently demonstrated here.
Mitigation direction
- Apply a vendor kernel update incorporating the applicable referenced stable fix.
- Check distribution advisories for corrected package versions and required restart guidance.
- Prioritize multi-user or otherwise untrusted systems using the Panfrost driver.
- If no update is available, request vendor-supported mitigation guidance.
Validation and detection
- Inventory running kernel versions and identify systems where the Panfrost driver is present or active.
- Compare vendor package changelogs or kernel source against the referenced fix commits.
- After updating, verify the running kernel contains the applicable correction.
- Reassess local-user access on exposed systems until remediation is confirmed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-50417 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0b70f6ea4d4f2b4d4b291d86ab76b4d07394932cCVE reference, Linux
- https://git.kernel.org/stable/c/4f1105ee72d8c7c35d90e3491b31b2d9d6b7e33aCVE reference, Linux
- https://git.kernel.org/stable/c/3f9feffa8a5ab08b4e298a27b1aa7204a7d42ca2CVE reference, Linux
- https://git.kernel.org/stable/c/ba3d2c2380e7129b525a787489c0b7e819a3b898CVE reference, Linux
- https://git.kernel.org/stable/c/4217c6ac817451d5116687f3cc6286220dc43d49CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.