CVE-2022-50015: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50015 is a NULL pointer dereference vulnerability in the Linux kernel's ASoC (Advanced Linux Sound Architecture) SOF (Sound Open Firmware) Intel HDA IPC (Inter-Processor Communication) component. The flaw occurs when the kernel processes an IPC reply message before the firmware boot completes — specifically, before the FW_READY message is received and reply_data is allocated. It affects Linux kernel versions from 5.2 up to (but not including) 5.19.4, and was published on June 18, 2025. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Microsoft).

The root cause is classified as CWE-476 (NULL Pointer Dereference). In the hda-ipc driver, reply_data is only allocated after the FW_READY message is received from the firmware. If a broken or malicious firmware sends a reply message before FW_READY, the kernel attempts to dereference the uninitialized (NULL) reply_data pointer, triggering a kernel panic. The issue affects both IPC3 and IPC4 firmware paths, though it was initially reported in the context of IPC4 firmware. The fix involves filtering out IPC reply messages received before firmware boot is complete (Feedly, kernel patch 1, kernel patch 2).

Successful exploitation allows a local attacker with low privileges to cause a kernel NULL pointer dereference, resulting in a system crash (kernel panic) or denial of service requiring a reboot. There is no impact on confidentiality or data integrity; the vulnerability is limited to availability. The affected component is the Linux sound subsystem (ASoC SOF Intel HDA), so exploitation is constrained to systems with compatible Intel HDA audio hardware running affected kernel versions (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The EPSS score is approximately 0.018%, indicating very low probability of exploitation in the near term. The attack requires local access with low privileges and the presence of specific Intel HDA audio hardware with SOF firmware support. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

Update the Linux kernel to version 5.19.4 or later, which includes the fix for this vulnerability. Patches are available in the Linux kernel stable git repository at commits 48945246cf80 and 499cc881b09c. Microsoft has also addressed this in CBL-Mariner (Azure Linux) kernel package cbl2_kernel_5.15.186.1-1. As an additional precaution, ensure only trusted, validated firmware is used with Intel HDA SOF devices, and restrict local user access on affected systems where immediate patching is not possible (kernel patch 1, kernel patch 2, Microsoft).

SUSE issued kernel security advisories (SUSE-2025-02264-1 and SUSE-2025-2264-1) addressing this and related kernel vulnerabilities, indicating distribution-level attention to the fix. Coverage has been limited to vendor advisory channels and security scanner detections (Qualys, Tenable/Nessus plugin 245684), with no notable public researcher commentary or social media discussion observed (Linux Security SUSE advisory, Tenable).