CVE-2022-50099: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50099 is a memory corruption vulnerability in the Linux kernel's framebuffer (fbdev) driver for Ark Logic graphics chips (arkfb). The flaw exists in the arkfb_set_par() function, where an insufficiently validated screen_size value derived from user input can exceed the allocated info->screen_size, causing an out-of-bounds write via memset_io(). Affected kernel versions span from 2.6.22 through 5.19.1, with fixed versions including 4.14.291, 4.19.256, 5.4.211, 5.10.137, 5.15.61, 5.18.18, and 5.19.2. The vulnerability was published on June 18, 2025, and carries a CVSS v3.1 base score of 7.8 (High) (Feedly).

The root cause is improper input validation (CWE-20) in the arkfb_set_par() function within the Linux kernel's drivers/video/fbdev/arkfb.c. When a low-privileged local user issues an FBIOPUT_VSCREENINFO ioctl with crafted framebuffer parameters, the computed screen_size can exceed the actual mapped framebuffer memory region. The subsequent memset_io() call then writes beyond the allocated I/O memory, triggering a kernel page fault (BUG: unable to handle page fault for address: ffffc90003000000) as observed in the call trace: memset_orig → arkfb_set_par → fb_set_var → do_fb_ioctl → fb_ioctl. The fix adds a bounds check on screen_size before the memset_io() call (Feedly, Kernel Patch).

Successful exploitation by a low-privileged local attacker can result in high impact to confidentiality, integrity, and availability of the affected system. The out-of-bounds write can cause kernel crashes (denial of service), and in more sophisticated scenarios may enable arbitrary code execution in kernel context, potentially leading to full system compromise. The vulnerability is scoped to the local machine and does not directly enable lateral movement, but kernel-level code execution could be leveraged for privilege escalation (Feedly).

There is no public proof-of-concept exploit or evidence of in-the-wild exploitation for CVE-2022-50099 at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. Exploitation requires local access with at least low privileges and a system running an Ark Logic framebuffer device or the arkfb kernel module loaded.

The primary remediation is to update the Linux kernel to a patched version. Fixed versions are available across all affected stable branches: 4.14.291, 4.19.256, 5.4.211, 5.10.137, 5.15.61, 5.18.18, and 5.19.2 (Kernel Patch). As a workaround on systems that do not use Ark Logic graphics hardware, administrators can blacklist the arkfb kernel module (echo 'blacklist arkfb' >> /etc/modprobe.d/blacklist.conf) to prevent the vulnerable code path from being loaded. SUSE and openSUSE have issued security advisories with updated kernel packages for their distributions (SUSE Advisory).

SUSE and openSUSE have issued security advisories addressing CVE-2022-50099 as part of broader Linux kernel update packages, indicating active vendor response for enterprise distributions (SUSE Advisory, openSUSE Advisory). No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability.