Security readout for executives and security teams
Plain-English summary
CVE-2022-50873 is a Linux kernel bug in the vp_vdpa driver cleanup path. When a vDPA management device is removed, the kernel may free the wrong pointer and crash. The main business impact shown by the source is service disruption, not confirmed data theft or remote compromise.
Executive priority
Treat as a targeted availability risk for Linux infrastructure using vDPA. It is not supported by current sources as an internet-wide emergency. Patch through normal kernel maintenance, with higher urgency for virtualization or networking hosts that rely on vDPA.
Technical view
The resolved issue is in vp_vdpa_remove(), where kfree(&vp_vdpa_mgtdev->mgtdev.id_table) passes the address of a pointer rather than the allocated pointer. The CVE record includes an ARM64 kernel oops trace. Linux stable references provide fixes for affected kernel branches.
Likely exposure
Exposure is likely limited to Linux systems running affected kernel versions with the vp_vdpa/vDPA path present or used. The source lists Linux kernel 5.19-era affected content and fixed stable versions/commits. Systems not using this driver path may have lower practical exposure.
Exploitation context
No cited source states active exploitation, and the CVE is not marked KEV. The described trigger is device removal in the vp_vdpa driver path, causing a kernel crash. Public sources provided do not describe remote exploitation, privilege escalation, or exploit availability.
Researcher notes
Evidence is limited to the kernel CVE text and stable commits. The issue is a wrong-pointer free in a remove path, with crash evidence. No CVSS, CWE, exploit status, or distribution-specific advisories are included in the provided bundle.
Mitigation direction
- Apply vendor kernel updates that include the referenced Linux stable fixes.
- Prioritize hosts using vDPA, virtio, or vp_vdpa-related functionality.
- If patch status is unclear, check your Linux distribution’s advisory for CVE-2022-50873.
- Consider reducing use of affected vDPA paths until patched, where operationally feasible.
Validation and detection
- Inventory Linux kernel versions across servers and appliances.
- Check whether vendor kernels include the referenced stable commits.
- Identify systems with vp_vdpa or vDPA functionality enabled or in use.
- Review crash logs for kernel oops events during vDPA device removal.
- Confirm patched systems run fixed vendor kernel builds after reboot.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50873 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.