PT-2025-25984 · Linux+2 · Linux Kernel+2

Published 2022-08-11 · Updated 2025-06-18 · CVE-2022-50058

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:L/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been resolved. The issue is related to the vdpa sim blk device, where two new fields (nas, ngroups) were added to vdpasim dev attr but not initialized, causing a kernel panic when creating a new vdpa sim blk device. The panic occurs due to a NULL pointer dereference in the vhost iotlb add range ctx function. The vulnerability is caused by vdpasim->iommu[0] not being initialized when dev attr.nas is 0.

Recommendations To resolve the issue, initialize both nas and ngroups to 1 for vdpa sim blk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Resource Release

NULL Pointer Dereference

Weakness Enumeration

CWE-404

CWE-476

Related Identifiers

BDU:2026-04876

CVE-2022-50058

RHSA-2023:2458

RHSA-2023_2458

Affected Products

Astra Linux

Linux Kernel

Red Hat

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50058.json · Exploit
• https://git.kernel.org/stable/c/19cd4a5471b8eaa4bd161b0fdb4567f2fc88d809 · Patch
• https://bdu.fstec.ru/vul/2026-04876 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-50058 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-50058 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50058 · Security Note
• https://git.kernel.org/stable/c/a291c7d289fac2cb13fb2614a9a251afbbd86ce9 · Patch
• https://ubuntu.com/security/CVE-2022-50058 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-50058 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-50058 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-50058 · Vendor Advisory
• https://access.redhat.com/security/cve/cve-2022-50058 · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://lore.kernel.org/linux-cve-announce/2025061848-CVE-2022-50058-212f@gregkh/T · Note
• https://twitter.com/CVEnew/status/1935356219998281772 · Twitter Post