PT-2025-49688 · Linux+1 · Linux Kernel+1

Published 2025-12-09 · Updated 2025-12-09 · CVE-2022-50657

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel’s memory management related to the KASAN (Kernel Address Sanitizer) initialization process. Specifically, a missing memcpy operation during kasan init can lead to a panic. This occurs because the newly allocated page directory entries (base pud, base p4d) do not contain the content of the early shadow structures (kasan early shadow pud, kasan early shadow p4d). This omission can result in a page fault when accessing the KASAN shadow region. The issue was tested on QEMU with both sv57 and sv48 configurations, with KASAN enabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2022-50657

Affected Products

Linux Kernel

Qemu

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50657.json · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-50657 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-50657 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-50657 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50657 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-50657 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-50657 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-50657 · Security Note
• https://git.kernel.org/stable/c/9f2ac64d6ca60db99132e08628ac2899f956a0ec · Note
• https://git.kernel.org/stable/c/ff0f6becf3a6f817838b6f80a2c9cca43dce0576 · Note
• https://git.kernel.org/linus/9f2ac64d6ca60db99132e08628ac2899f956a0ec · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://twitter.com/CVEnew/status/1998355395681914970 · Twitter Post