CVE-2022-50145: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50145 affects the Linux kernel's DMA engine, specifically the StarFive PDMA driver (sf-pdma). The vulnerability was discovered and publicly disclosed on June 18, 2025. The issue occurs when attempting to use DMA channels in multiple threads, which can lead to system crashes and hangs (NVD, Wiz).

The vulnerability is caused by a data race condition where each thread rewrites the channel's descriptor upon calling device_prep_dma_memcpy(). This leads to situations where the driver incorrectly believes it's using the right descriptor, which may have been freed or replaced by another thread. The issue manifests as NULL pointer dereferences at virtual address 0x000000000000a0, resulting in system oops and hangs (NVD, Wiz).

When exploited, this vulnerability causes system instability through NULL pointer dereferences and system hangs. The issue can be triggered by running multiple threads that access the same DMA channel, potentially leading to system crashes and denial of service conditions (Wiz).

The issue has been fixed by modifying how descriptors are handled. In the patched version, a descriptor only changes its value after it has been used, and new descriptors are acquired from a pre-filled vc->desc_issued queue. Threads no longer have direct access to DMA channel descriptors and can only queue descriptors for further processing (Wiz).