Security readout for executives and security teams
Plain-English summary
This is a Linux kernel graphics driver bug in the MSM/Adreno A6xx code. The vulnerable code used a memory allocation helper incompatible with a function that may reallocate/free memory. Business impact is unclear because no CVSS, CWE, or exploitation evidence is provided. Prioritize affected Linux systems that actually ship this driver.
Executive priority
Treat as a targeted kernel maintenance issue, not an emergency based on current evidence. Give priority to embedded, mobile, or graphics-enabled Linux assets using this driver, and fold remediation into normal kernel update cycles unless vendor advisories raise severity.
Technical view
The fix changes adreno_show_object() state allocation from state_kcalloc() to kvzalloc()/kvfree-compatible handling. The CVE text says adreno_show_object() can reallocate an ASCII85-encoded buffer with kvmalloc/kvfree, so the caller must pass kvmalloc-backed memory. References are Linux stable commits.
Likely exposure
Exposure appears limited to Linux kernels in the affected version ranges with the drm/msm/a6xx Adreno driver present or used. Generic servers without this driver are less likely to be exposed, but kernel package backports can change version-based assumptions.
Exploitation context
No active exploitation is reported in the provided sources, and the CVE is not marked KEV. The sources do not provide exploitability details, attacker prerequisites, or demonstrated impact beyond the kernel memory-management fix description.
Researcher notes
Public data is sparse: no CVSS, CWE, or exploit report is included. Analysis should focus on commit review, affected kernel lineage, distribution backports, and whether reachable driver paths exist on deployed hardware. Avoid assuming exposure from upstream version numbers alone.
Mitigation direction
- Review Linux vendor advisories for CVE-2022-50867 and the msm/a6xx driver fix.
- Update affected kernels to builds containing the referenced stable commits or vendor backports.
- Prioritize devices using Qualcomm Adreno A6xx/MSM graphics support.
- If updates are unavailable, follow vendor guidance for driver exposure reduction.
Validation and detection
- Inventory Linux kernel versions across device fleets.
- Check whether drm/msm/a6xx support is built or loaded.
- Verify kernel changelogs include the referenced stable commits or equivalent backports.
- Confirm distribution security trackers list the installed kernel as fixed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50867 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.