LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50582: regulator: core: Prevent integer underflow

In the Linux kernel, the following vulnerability has been resolved: regulator: core: Prevent integer underflow By using a ratio of delay to poll_enabled_time that is not integer time_remaining underflows and does not exit the loop as expected. As delay could be derived from DT and poll_enabled_time is defined in the driver this can easily happen. Use a signed iterator to make sure that the loop exits once the remaining time is negative.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

A bug in the Linux kernel's regulator (power management) code could cause a loop to run far longer than intended because a counter could go negative without being detected. This is an internal reliability flaw in Linux, not a remote attack vector. Impact is limited to systems running specific kernel versions, and a fix has been merged upstream.

Executive priority

Low priority. This is a Linux kernel stability bug with no evidence of active exploitation, no CVSS score, and no KEV listing. Address through normal patch cycles, prioritizing embedded and IoT fleets that may run vulnerable kernels.

Technical view

In the Linux kernel regulator core, a polling loop used an unsigned iterator for time_remaining. When the ratio of delay to poll_enabled_time was non-integer, the value could underflow instead of going negative, causing the loop to not exit as expected. The fix changes the iterator to a signed type so the loop terminates when remaining time becomes negative. Affected versions span 5.9 through 6.1, fixed in 5.10.150, 5.15.75, 5.19.17, and 6.0.3.

Likely exposure

Linux systems running kernels between 5.9 and 6.1 that load drivers using the regulator framework with non-integer delay/poll_enabled_time ratios (often derived from device tree). Primarily relevant to embedded, ARM, and SoC platforms; general-purpose servers using x86 are less likely to encounter the triggering configuration.

Exploitation context

No CVSS, CWE, or KEV entry is provided in the source bundle, and no public exploitation has been reported. The defect appears to be a local reliability and stability issue triggered by specific driver and device tree configurations, not a remotely reachable vulnerability. Treat as a stability bug pending further vendor scoring.

Researcher notes

The CVE record lacks CVSS, CWE, and exploitation metadata, so severity assessment is provisional. The five referenced kernel.org commits indicate stable backports across multiple branches. Mainline fix landed before 6.1. Consider this primarily a denial-of-service / hang risk on platforms whose device tree produces non-integer delay-to-poll ratios in regulator drivers. No PoC, KEV entry, or active exploitation cited.

Mitigation direction

  • Update Linux kernel to 5.10.150, 5.15.75, 5.19.17, 6.0.3, or 6.1+ where the fix is included.
  • Apply the upstream stable patches referenced in the kernel.org commits if rolling a custom kernel.
  • Track distribution security advisories (Debian, Ubuntu, RHEL, SUSE) for backported fixes.
  • Where patching is delayed, audit device tree delay values against driver poll_enabled_time to avoid the trigger condition.
  • Subscribe to vendor channels for embedded/SoC platforms to confirm fix inclusion in BSP kernels.

Validation and detection

  • Run uname -r and compare against fixed versions: 5.10.150, 5.15.75, 5.19.17, 6.0.3, 6.1.
  • Check distribution package changelog for the regulator core integer underflow fix or referenced commit hashes.
  • On custom kernels, grep drivers/regulator/core.c for signed time_remaining iterator to confirm patch presence.
  • Review kernel boot logs and dmesg for regulator driver hangs or watchdog timeouts that may indicate the bug.
  • Confirm no out-of-tree regulator drivers reintroduce the unsigned-iterator pattern.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50582 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxf7d7ad42a9dc2d63cab6a79fe31e6732a30dacf5, f7d7ad42a9dc2d63cab6a79fe31e6732a30dacf5, f7d7ad42a9dc2d63cab6a79fe31e6732a30dacf5, f7d7ad42a9dc2d63cab6a79fe31e6732a30dacf5, f7d7ad42a9dc2d63cab6a79fe31e6732a30dacf5unaffected
LinuxLinux5.9, 0, 5.10.150, 5.15.75, 5.19.17, 6.0.3, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.