CVE-2022-50195: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-50195 is a Linux kernel vulnerability in the ARM device tree support for Qualcomm (QCOM) platforms, where an incorrect phandle reference to the gcc PXO clock source can trigger a kernel panic. The root cause is that the gcc driver does not provide PXO_SRC as it is a fixed-clock, and any driver attempting to use it causes a system crash. It affects Linux kernel versions from 5.14 up to (but not including) 5.19.2. The vulnerability was published on June 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is classified under improper resource handling in the Linux kernel's ARM device tree configuration for Qualcomm SoCs (CWE-476 or similar null/invalid pointer dereference). The device tree source (DTS) incorrectly references the gcc PXO phandle instead of the pxo_board fixed clock declared in the DTS; since the gcc driver does not expose PXO_SRC, any driver that attempts to use this clock source triggers a kernel panic. Exploitation requires local access and low privileges — an attacker or a misconfigured driver on an affected Qualcomm ARM system can trigger the panic by invoking the affected clock path. The fix replaces the gcc PXO phandle with the correct pxo_board fixed clock reference in the DTS (Red Hat Bugzilla, git.kernel.org).

Successful exploitation results in a kernel panic, causing a complete system crash and denial of service on affected Linux systems running on Qualcomm ARM hardware. The impact is limited to availability — there is no confidentiality or integrity impact. Systems running Linux kernel versions 5.14 through 5.19.1 on Qualcomm-based ARM platforms are at risk of service interruption if a driver attempts to use the misconfigured PXO clock source (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2022-50195. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Red Hat Advisory).

The fix is included in Linux kernel version 5.19.2 and later, which replaces the incorrect gcc PXO phandle with the pxo_board fixed clock in the Qualcomm ARM device tree. Users should update to kernel version 5.19.2 or apply vendor-specific patches from Red Hat or kernel.org. As a secondary measure, administrators should verify device tree configurations on Qualcomm-based ARM systems and monitor for unexpected kernel panics (Red Hat Bugzilla, git.kernel.org).