CVE-2022-50231: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50231 is an out-of-bounds read vulnerability in the Linux kernel's ARM64 Poly1305 cryptographic implementation (the poly1305_neon module). The flaw exists in the neon_poly1305_blocks function, where improper initialization of memory buffers can cause reads beyond allocated memory boundaries. It was publicly disclosed on June 18, 2025, and affects Linux kernel versions 5.5–5.10.135, 5.11–5.15.59, 5.16–5.18.16, and 5.19–5.19.0. The vulnerability carries a CVSS v3.1 base score of 7.1 (High) (Feedly).

The root cause is classified as CWE-125 (Out-of-bounds Read), triggered within the neon_poly1305_blocks.constprop.0 function of the poly1305_neon kernel module on ARM64 systems. A KASAN (Kernel Address Sanitizer) report captured during fuzzing showed a slab-out-of-bounds read of 4 bytes at an address beyond the allocated slab region, occurring during cryptographic hash operations via the call chain neon_poly1305_update → neon_poly1305_do_update → neon_poly1305_blocks. Exploitation requires local access with low privileges (no user interaction needed), and the attacker must be able to trigger Poly1305 NEON cryptographic operations on an affected ARM64 system. The vulnerability was discovered through kernel fuzzing using syz-executor on a Huawei TaiShan 2280 platform running kernel 5.10.0 aarch64 (Feedly).

Successful exploitation could allow a local attacker with low privileges to read sensitive kernel memory contents beyond the intended buffer boundary, leading to unauthorized information disclosure of kernel data. Additionally, the out-of-bounds read may cause system instability or a kernel crash, impacting availability. The vulnerability is scoped to the local system and does not directly enable code execution or privilege escalation, but leaked kernel memory could facilitate further attacks (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

Patches have been released for all affected kernel stable branches. Users should upgrade to one of the following fixed versions: 5.10.136+, 5.15.60+, 5.18.17+, or 5.19.1+. The fixes are available in the Linux stable kernel repository. As a workaround where patching is not immediately possible, restricting local user access to the system reduces exposure. Applying kernel security updates as soon as possible is the recommended remediation (Feedly, Kernel Patch 1, Kernel Patch 2).

Coverage has been limited to automated vulnerability tracking platforms and German Linux security news (pro-linux.de). No notable researcher commentary or significant community discussion has been identified beyond standard vulnerability database entries (Feedly).