CVE-2022-50011: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50011 is a vulnerability in the Linux kernel's Venus video codec driver (venus_core) related to incorrect ordering of Operating Performance Point (OPP) configuration during device probe. The flaw triggers a kernel WARN in dev_pm_opp_set_config (at drivers/opp/core.c:2471) when the Venus driver is probed on Qualcomm-based systems. It affects Linux kernel versions before 5.15.63 and versions from 5.16 up to (but not including) 5.19.4. The CVE was published on June 18, 2025, with a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Kernel Patches).

The root cause is an improper ordering of OPP (Operating Performance Point) configuration steps within the Venus driver's probe routine (pm_helpers), classified under CWE-665 (Improper Initialization). Specifically, the OPP table is added before the OPP core's configuration prerequisites are met, causing dev_pm_opp_set_config to emit a kernel warning (WARN) during driver initialization on Qualcomm platforms such as the Robotics RB5. The fix re-orders the OPP core configuration calls so that required setup is completed before the OPP table is populated. The vulnerability is local in nature and requires low privileges to trigger, as it manifests during normal device initialization via systemd-udevd (Feedly, Kernel Patches).

Exploitation of this vulnerability can cause system instability and probe failures in the Venus video codec driver on Qualcomm-based Linux systems, resulting in a high availability impact. Affected systems may experience degraded or non-functional video codec hardware, and the kernel warning may interfere with device initialization during boot. There is no confidentiality or integrity impact; the vulnerability is limited to a denial-of-service condition on the affected hardware subsystem (Feedly).

There is no known public proof-of-concept exploit for CVE-2022-50011, and no evidence of in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017%, reflecting a very low probability of exploitation (Feedly).

Update the Linux kernel to version 5.15.63 or later (for the 5.15.x stable branch), or to version 5.19.4 or later (for the 5.16–5.19.x range). Three upstream patches have been provided and are available in the stable kernel tree. No configuration-based workaround is documented; upgrading to a patched kernel version is the recommended remediation (Kernel Patches, Kernel Patches, Kernel Patches). SUSE has also issued advisories incorporating this fix for their enterprise kernel packages (Linux Security SUSE).

SUSE has issued multiple security advisories addressing CVE-2022-50011 as part of broader Linux kernel update packages (Linux Security SUSE, Linux Security SUSE 2). No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability.