CVE-2022-50225: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-50225 is an improper locking vulnerability in the Linux kernel's RISC-V architecture uprobe (user-space probe) subsystem, specifically in the handling of the Supervisor Previous Interrupt Enable (SPIE) flag. The flaw causes a kernel warning and potential system instability when a page fault occurs while interrupts are disabled during uprobe execution. It affects Linux kernel versions 5.12 through 5.19 (specifically before 5.15.61, 5.18.18, and 5.19.2) and was published on June 18, 2025. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as CWE-667 (Improper Locking). In the RISC-V uprobe implementation, arch_uprobe_pre_xol disables interrupts (IRQ) before executing the original instruction, but the code also incorrectly clears and sets the SPIE (Supervisor Previous Interrupt Enable) flag around this execution. If a page fault occurs while IRQs are disabled — for example, when accessing the page containing the original instruction — the kernel attempts to call a sleeping function (down_read on an rwsem) from an invalid atomic/IRQ-disabled context, triggering a BUG: sleeping function called from invalid context warning. The fix removes the unnecessary SPIE clear/set operations from arch_uprobe_pre_xol, arch_uprobe_post_xol, and arch_uprobe_abort_xol (Feedly, Kernel Patch).

Successful exploitation allows a local authenticated user to trigger kernel warnings and potential system instability on RISC-V systems running affected Linux kernel versions. The impact is limited to availability — there is no confidentiality or integrity impact — but the resulting kernel instability could lead to denial of service conditions on affected RISC-V hardware. The scope is unchanged and confined to the local system (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The EPSS score is approximately 0.018%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local authenticated access to a RISC-V system running an affected kernel version and the ability to trigger uprobe activity with a page fault (Feedly).

• Logs: Kernel log entries containing BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1488 on RISC-V systems.
• Logs: Kernel messages showing irqs_disabled(): 1 alongside uprobe-related stack traces including do_page_fault and arch_uprobe_pre_xol in the call trace.
• Process: Unusual process behavior on RISC-V systems where uprobe-instrumented processes (e.g., processes being traced with perf probe or similar tools) crash or hang unexpectedly.

Update the Linux kernel to a patched version: 5.15.61, 5.18.18, or 5.19.2, which remove the erroneous SPIE clear/set operations from the RISC-V uprobe execution path. Systems running kernel versions between 5.12 and 5.19 on RISC-V hardware should prioritize this update. As a temporary measure, restricting local user access and limiting the use of uprobe-based tracing tools on affected systems can reduce exposure (Feedly, Kernel Patch).