CVE-2022-50200: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50200 is an out-of-bounds read vulnerability in the Linux kernel's SELinux subsystem, specifically caused by a missing boundary check in the put_entry() function. The fix mirrors the existing boundary check pattern used in next_entry() to prevent memory out-of-bounds access during SELinux policy operations. Affected kernel versions span from 2.6.37 through 5.19.x, with fixed versions including 4.14.291, 4.19.256, 5.4.211, 5.10.137, 5.15.61, 5.18.18, and 5.19.2. The CVE was published on June 18, 2025, and carries a CVSS v3.1 base score of 7.1 (High) (Feedly, kernel.org patches).

The root cause is classified as CWE-125 (Out-of-bounds Read), specifically a missing boundary check in the SELinux put_entry() function within the Linux kernel's security policy binary parsing code. Unlike next_entry(), which already performed bounds validation, put_entry() lacked equivalent checks, allowing memory reads beyond the intended buffer boundary. Exploitation requires local access with low privileges, as an attacker would need to trigger the vulnerable code path through SELinux policy interactions. No public proof-of-concept or detailed technical write-up is currently available (Feedly).

Successful exploitation could allow a low-privileged local attacker to read sensitive kernel memory contents (high confidentiality impact) and potentially cause system instability or crashes (high availability impact). Integrity is not directly affected. The vulnerability is scoped to the local system and does not inherently enable lateral movement, but sensitive memory disclosure could expose credentials, cryptographic material, or other privileged data that could facilitate further attacks (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. Exploitation requires local access with at least low-privilege credentials, limiting the attack surface (Feedly).

Update the Linux kernel to a patched version addressing this vulnerability. Fixed versions are available across multiple stable branches: 4.14.291, 4.19.256, 5.4.211, 5.10.137, 5.15.61, 5.18.18, and 5.19.2. Patches are available via kernel.org stable trees and have been incorporated into vendor distributions including SUSE (SUSE-2025-02308-1) and Red Hat (RHSA-2025:14054, RHSA-2025:14094). As an interim measure, enforce strict access controls and least-privilege principles to limit local user access to affected systems (kernel.org patches, Red Hat Advisory, SUSE Advisory).