Security readout for executives and security teams
Plain-English summary
A flaw in the Linux kernel's HiSilicon HPRE crypto accelerator driver could leak system resources when the device is removed and a related cleanup step fails. In practice, a local user on a server with this hardware could trigger conditions that destabilize the system over time. There is no remote exposure and no sign of active exploitation.
Executive priority
Low priority. Schedule alongside routine kernel patching cycles. No emergency action is needed unless your fleet relies on HiSilicon Kunpeng servers using HPRE crypto offload, in which case include in the next maintenance window.
Technical view
In hpre_remove(), if disabling QM SR-IOV failed, the driver returned early and skipped releasing remaining allocated resources, causing a memory/resource leak (CWE-401). The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H reflects local, low-privilege impact limited to availability. Fixes were merged across 5.15.86, 6.0.16, 6.1.2, and mainline 6.2 via the referenced stable kernel commits.
Likely exposure
Limited to Linux systems running affected kernel versions (pre-5.15.86, pre-6.0.16, pre-6.1.2, pre-6.2) on hardware with HiSilicon HPRE crypto accelerators - typically Kunpeng/Hi1620-class servers. Workstations, cloud VMs without device passthrough, and non-HiSilicon platforms are not exposed.
Exploitation context
Not listed in CISA KEV; no public exploit or in-the-wild activity is cited. Triggering the leak requires local access and repeated driver remove operations with failing SR-IOV disable. Impact is availability-only over time, with no confidentiality or integrity exposure.
Researcher notes
Bug class is a missing-cleanup-on-error path (CWE-401) in drivers/crypto/hisilicon/hpre. Fix changes hpre_remove() to continue tearing down resources after qm_sriov_disable failure. Reachability is gated by hardware presence and driver remove timing, so practical exploitability is narrow. Worth flagging in SBOM/firmware reviews for Arm64 server platforms shipping HiSilicon accelerators.
Mitigation direction
- Patch affected Linux kernels to 5.15.86, 6.0.16, 6.1.2, 6.2, or later stable releases.
- Apply your distribution vendor's backported fix for CVE-2022-50420 if running an enterprise kernel.
- Restrict local shell and driver-management privileges on hosts with HiSilicon HPRE accelerators.
- Track HPRE driver load/unload events in change management on affected hardware fleets.
Validation and detection
- Run uname -r and compare against fixed versions 5.15.86, 6.0.16, 6.1.2, and 6.2.
- Check distro changelogs (rpm -q --changelog kernel or apt changelog linux-image) for CVE-2022-50420 references.
- Confirm whether HiSilicon HPRE hardware is present via lspci and whether the hpre module is loaded.
- Monitor kernel memory usage and dmesg around HPRE driver removal events to detect leak symptoms.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-50420 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/2b3e3ecdb402ff1053ee25b598ff21b9ddf4384fCVE reference
- https://git.kernel.org/stable/c/4e0de941d252d4e7c985981e78480c8d6f020b64CVE reference
- https://git.kernel.org/stable/c/cb873c93a7ad27681920bf062ef052fca1e8d5b1CVE reference
- https://git.kernel.org/stable/c/45e6319bd5f2154d8b8c9f1eaa4ac030ba0d330cCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.