LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50453: gpiolib: cdev: fix NULL-pointer dereferences

In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: fix NULL-pointer dereferences There are several places where we can crash the kernel by requesting lines, unbinding the GPIO device, then calling any of the system calls relevant to the GPIO character device's annonymous file descriptors: ioctl(), read(), poll(). While I observed it with the GPIO simulator, it will also happen for any of the GPIO devices that can be hot-unplugged - for instance any HID GPIO expander (e.g. CP2112). This affects both v1 and v2 uAPI. This fixes it partially by checking if gdev->chip is not NULL but it doesn't entirely remedy the situation as we still have a race condition in which another thread can remove the device after the check.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel availability issue. A local process with access to GPIO character devices may be able to crash the system when a GPIO device is removed while file descriptors remain active. The supplied sources point to denial of service, not data theft or remote compromise.

Executive priority

Treat as moderate priority for embedded and hardware-control environments where a crash can interrupt operations. For general-purpose servers without GPIO exposure, track through normal kernel patching unless local untrusted users can access relevant devices.

Technical view

CVE-2022-50453 is a NULL-pointer dereference in Linux gpiolib character-device handling. It affects both v1 and v2 GPIO uAPIs. The crash path involves requested GPIO lines, device unbinding or hot-unplug, and later GPIO character-device operations. The source notes the referenced fix adds NULL checks but does not fully eliminate a remaining race.

Likely exposure

Most exposed systems are Linux hosts using GPIO character devices, especially platforms with hot-unpluggable GPIO hardware such as HID GPIO expanders. Servers without GPIO device exposure are less likely to be affected, but embedded, industrial, lab, and hardware-control systems need review.

Exploitation context

The bundle does not show active exploitation, and CISA KEV is false. The described condition requires access to GPIO character-device functionality and a device removal or unbind scenario. Evidence supports local denial of service rather than remote code execution.

Researcher notes

The source states the initial NULL-check fix is partial because a race remains after the check. Avoid assuming complete remediation from commit presence alone; confirm downstream vendor handling and test relevant hot-unplug scenarios safely in a lab.

Mitigation direction

  • Apply vendor-supported kernel updates containing the referenced stable fixes.
  • Prioritize systems using hot-pluggable GPIO or HID GPIO expander hardware.
  • Review vendor advisories for complete backport status and residual race guidance.
  • Restrict untrusted access to GPIO character devices where operationally feasible.

Validation and detection

  • Inventory Linux kernel versions against the affected ranges in the CVE record.
  • Identify systems exposing GPIO character devices to local users or services.
  • Check whether vendor kernels include the listed stable commit backports.
  • Review kernel logs for GPIO-related NULL-pointer crashes or panics.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50453 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxd7c51b47ac11e66f547b55640405c1c474642d72, d7c51b47ac11e66f547b55640405c1c474642d72, d7c51b47ac11e66f547b55640405c1c474642d72, d7c51b47ac11e66f547b55640405c1c474642d72, d7c51b47ac11e66f547b55640405c1c474642d72unaffected
LinuxLinux4.8, 0, 5.10.163, 5.15.86, 6.0.16, 6.1.2, 6.2affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.