CVE-2022-50315: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50315 is an array index out-of-bounds vulnerability in the Linux kernel's AHCI (Advanced Host Controller Interface) driver, specifically in drivers/ata/libahci.c. The flaw arises from a mismatch between EM_MAX_SLOTS (defined as 8) and SATA_PMP_MAX_PORTS (up to 16), causing out-of-bounds access to the em_priv array when a SATA Port Multiplier with more than 8 ports is attached. It was publicly disclosed on September 15, 2025, and affects Linux kernel versions from 4.9 up to 6.1-rc1 across multiple stable branches. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-129 (Improper Validation of Array Index). In libahci.c, the function ahci_qc_issue() accesses link->ap->em_priv[link->pmp], where link->pmp is initialized by sata_pmp_init_links() up to SATA_PMP_MAX_PORTS (15), but em_priv is declared as an array of only 8 elements (ahci_em_priv[8]). When a SATA Port Multiplier with more than 8 ports is connected, the index exceeds the array bounds, triggering a UBSAN out-of-bounds error. The fix aligns EM_MAX_SLOTS with SATA_PMP_MAX_PORTS to ensure the array is sized correctly. The AHCI spec v1.3.1 section 12.2.1 implies up to 16 ports can be addressed via 4-bit Port Multiplier Information fields, confirming the need for the larger array size (Red Hat Bugzilla).

Successful exploitation could allow a local attacker with low privileges to trigger kernel memory corruption via an out-of-bounds array access, potentially leading to kernel crashes (denial of service), information disclosure from adjacent kernel memory, or arbitrary code execution in kernel context. The CVSS v3.1 score reflects high impacts on confidentiality, integrity, and availability. The attack is limited to local access and requires the presence of a SATA Port Multiplier device with more than 8 ports (Red Hat Advisory, Red Hat Bugzilla).

Patches are available for multiple Linux kernel stable branches. Fixed versions include: 4.9.332, 4.14.298, 4.19.264, 5.4.221, 5.10.152, 5.15.76, and 6.0.6. Upstream kernel commits are available via the stable kernel repository. If immediate patching is not possible, mitigations include restricting physical and local system access, limiting attachment of SATA Port Multiplier devices with more than 8 ports, and enabling kernel runtime protection mechanisms such as UBSAN or KASAN to detect and contain the issue. Upgrading to a patched kernel version is the recommended remediation (Red Hat Bugzilla, Kernel Patch).