CVE-2022-50245: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-50245 is a use-after-free (UAF) vulnerability in the Linux kernel's RapidIO device driver (drivers/rapidio/devices/rio_mport_cdev.c). The flaw occurs in the mport_cdev_open() function: when kfifo_alloc() fails, the error-handling path frees the private structure (priv) but does not remove it from chdev->file_list, leaving a dangling pointer that subsequent list traversals can dereference. It was publicly disclosed on September 15, 2025, and affects multiple Linux kernel stable branches from 4.6 through 6.1.x. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Red Hat CVE, Feedly).

The root cause is classified as CWE-416 (Use After Free). In mport_cdev_open(), the priv structure is added to chdev->file_list early in the function. If the subsequent kfifo_alloc() call fails, the error path (goto err_fifo) frees priv via kfree() without first calling list_del() to remove it from the linked list. Any later traversal of chdev->file_list — for example during device close or cleanup — will access the already-freed memory, constituting a UAF condition. This was originally flagged by the smatch static analysis tool with the warning: drivers/rapidio/devices/rio_mport_cdev.c:1930 mport_cdev_open() warn: '&priv->list' not removed from list (Red Hat CVE, Red Hat Bugzilla). The attack vector is local, requiring low privileges and no user interaction.

A local attacker with low-privilege access could exploit this vulnerability to cause kernel memory corruption, potentially leading to arbitrary code execution in kernel context, system crashes (kernel panic), or manipulation of kernel memory structures. Successful exploitation could result in full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability affects a wide range of kernel versions used across many Linux distributions, broadening the potential attack surface (Feedly, Red Hat CVE).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.033%, reflecting a very low probability of exploitation in the near term. Exploitation requires local access with at least low-privilege credentials, which further limits the practical attack surface.

The Linux kernel project has released patches across all affected stable branches. Administrators should update to the following fixed versions or later: 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, or 6.1.2 (Red Hat CVE, Red Hat Bugzilla). Vendor-specific patches are available via distribution security channels (e.g., Red Hat, Ubuntu, SUSE). As a compensating control, limiting local user access to systems with RapidIO hardware or restricting access to the /dev/rio_mport device node can reduce exposure until patching is feasible.