Security readout for executives and security teams
Plain-English summary
CVE-2022-50785 is a Linux kernel flaw in the fsi:occ driver. The issue could let kernel memory tied to a device be freed while still in use. Public data does not provide CVSS, confirmed exploitation, or a complete business impact statement.
Executive priority
Treat as a targeted kernel maintenance item, not an emergency based on current public evidence. Raise priority for platforms using the fsi:occ driver or where vendor advisories mark the issue important.
Technical view
The fix adds get_device/put_device in open/close paths so the device is not freed while a file descriptor remains open. It also locks around device-buffer freeing and checks the buffer before submit use. This is a use-after-free class issue in the Linux kernel fsi:occ code.
Likely exposure
Exposure appears limited to Linux systems running affected kernel versions with the fsi:occ driver in use or reachable. The CVE record lists Linux kernel versions including 5.16, 5.19.17, 6.0.3, and 6.1 as affected, but the source data is not fully clear on version ranges.
Exploitation context
No CISA KEV listing is provided, and the source bundle does not cite active exploitation or public exploit availability. The bug involves driver lifetime and buffer handling around open, close, and submit operations, suggesting local or device-interface reachability, but exact attack prerequisites are not stated.
Researcher notes
The record lacks CVSS, CWE, exploit status, and detailed affected-version range semantics. Analysis should focus on the three stable commits and downstream distro backports. Avoid assuming broader kernel impact beyond the fsi:occ code path named in the CVE.
Mitigation direction
- Review vendor kernel advisories for CVE-2022-50785 applicability.
- Update to a kernel build containing the referenced stable fixes.
- Prioritize systems where the fsi:occ driver is enabled or used.
- If not needed, consider disabling unused driver exposure per vendor guidance.
Validation and detection
- Inventory Linux kernel versions across affected fleets.
- Check whether the fsi:occ driver is built, loaded, or used.
- Confirm installed kernel includes one of the referenced stable commits.
- Document exceptions where vendor kernels have backported the fix.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50785 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.