CVE-2022-50133: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50133 is a NULL pointer dereference vulnerability in the Linux kernel's USB xHCI platform driver, specifically within the xhci_plat_remove function. The flaw was introduced after commit 4736ebd7fcaff1eb8481c140ba494962847d6e0a ("usb: host: xhci-plat: omit shared hcd if either root hub has no ports"), which allowed xhci->shared_hcd to be NULL — a condition not previously handled in the removal path. Affected versions are Linux kernel 5.19 through 5.19.1 (fixed in 5.19.2). It was publicly disclosed on June 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) in the xhci_plat_remove function of the Linux kernel's USB xHCI platform driver. A prior commit modified the xHCI platform host initialization to omit the shared HCD when either root hub has no ports, meaning xhci->shared_hcd can legitimately be NULL at removal time. However, xhci_plat_remove did not account for this possibility and proceeds to call usb_remove_hcd() on the potentially NULL shared_hcd pointer, triggering a kernel oops during system reboot or device removal. The attack vector is local, requiring low privileges, and no complex conditions are needed beyond triggering USB host controller removal on an affected system (Red Hat Bugzilla, Red Hat Advisory).

Successful triggering of this vulnerability causes a kernel oops (system crash) during USB xHCI host controller removal, most commonly observed during system reboot. The impact is limited to availability — there is no confidentiality or integrity impact — but the crash can interrupt the reboot process and cause unexpected system behavior. Systems running Linux kernel 5.19 or 5.19.1 with xHCI platform USB controllers are at risk of denial of service in this scenario (Red Hat Advisory, Red Hat Bugzilla).

There is no known public proof-of-concept exploit for CVE-2022-50133, and no evidence of in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting very low probability of exploitation in the near term (Red Hat Advisory).

The fix is available in Linux kernel version 5.19.2 and later, which adds a NULL check for xhci->shared_hcd before attempting to call usb_remove_hcd() in xhci_plat_remove. Patches are available in the upstream kernel stable tree. Users should update to kernel 5.19.2 or apply vendor-specific kernel patches as provided by their distribution. Additionally, monitoring system logs for USB-related kernel oops messages during reboot can help identify affected systems (Red Hat Bugzilla, Kernel Patch 1, Kernel Patch 2).