Security readout for executives and security teams
Plain-English summary
A flaw in the Linux kernel's rpmsg character device driver can cause the system to free the same internal object twice when a remote processor is stopped before its device file is closed. This can crash systems or, in worst cases, allow a logged-in user to corrupt kernel memory. It only affects machines that use rpmsg with co-processors, such as some embedded and IoT-style Linux devices.
Executive priority
Patch on the normal Linux kernel cadence. Treat as elevated priority for fleets of embedded, IoT, automotive, or edge devices that use rpmsg with co-processors and where local users or workloads can reach /dev/rpmsgX. Standard servers and desktops without rpmsg_char loaded can follow routine kernel update timelines.
Technical view
CVE-2022-50421 is a use-after-free (CWE-416) in drivers/rpmsg/rpmsg_char.c. rpmsg_chrdev_eptdev_destroy() destroyed the default endpoint that rpmsg_dev_remove() also releases, causing a refcount_t underflow on ept->refcount and a UAF path through virtio_rpmsg_destroy_ept(). Triggered by stopping remoteproc before closing /dev/rpmsgX. Fixed by aligning the destroy path with rpmsg_eptdev_release(). CVSS 3.1 base 7.8 (AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H).
Likely exposure
Limited to Linux systems that build and use the rpmsg character driver with virtio_rpmsg, typically embedded boards, automotive, telecom, and IoT platforms with co-processors (e.g., Cortex-M, DSP). Stock server and desktop distributions that do not load rpmsg_char are not exposed. Affected mainline range: 5.18 through 6.0.x and 6.1 prior to the stable backport commits.
Exploitation context
No public exploit, proof-of-concept, or in-the-wild activity is cited in the bundle, and the CVE is not listed in CISA KEV. Exploitation requires local access plus the ability to interact with /dev/rpmsgX and to stop remoteproc, so it is most relevant as a local privilege-escalation or denial-of-service primitive on devices exposing rpmsg to non-root users.
Researcher notes
Root cause is duplicated cleanup of the default endpoint between rpmsg_chrdev_eptdev_destroy() and rpmsg_dev_remove(), surfaced as a refcount_t underflow warning and UAF in virtio_rpmsg_destroy_ept(). Reproducer per commit message: stop remoteproc while /dev/rpmsgX is still open. Fix mirrors rpmsg_eptdev_release() so the core path owns destruction. Confirm backports landed in the stable trees you track; commits ef828a39, 3f20ef7a, and 467233a4 are the upstream references.
Mitigation direction
- Upgrade to a Linux kernel that includes the upstream fix (5.19.17, 6.0.3, or 6.1+) or your distro's backport.
- Apply the vendor or board-support-package kernel update for embedded, automotive, and IoT devices that ship rpmsg_char.
- Restrict access to /dev/rpmsgX and remoteproc sysfs controls to trusted system services only.
- If a patched kernel is not yet available, unload or disable rpmsg_char on systems that do not require it.
- Track downstream advisories from your Linux vendor for the specific stable branches you run.
Validation and detection
- Identify running kernel version and confirm whether it is between 5.18 and the patched stable releases listed in the kernel.org commits.
- Check whether rpmsg_char and virtio_rpmsg modules are loaded and whether /dev/rpmsgX nodes are present.
- Inventory devices that use remoteproc co-processors (embedded, automotive, telecom, IoT) for exposure.
- Review which users or services can open /dev/rpmsgX and control remoteproc start/stop.
- After patching, confirm the fix commits (ef828a39, 3f20ef7a, 467233a4) are present in the deployed kernel source or changelog.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-50421 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.