CVE-2022-50317: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50317 is a NULL pointer dereference vulnerability in the Linux kernel's drm/bridge megachips driver (megachips_stdpxxxx_ge_b850v3_fw). The flaw occurs during module removal when the two bridges (stdp2690 and stdp4028) have not both completed probing, causing the driver to attempt removal of an uninitialized object and triggering a general protection fault. It was publicly disclosed on September 15, 2025, and affects multiple Linux kernel stable branches. Affected versions include 4.14.263–4.14.296, 4.19.226–4.19.262, 5.4.174–5.4.220, 5.10.94–5.10.150, 5.15.17–5.15.75, 5.16.3–5.19.17, and 6.0–6.0.3. The CVSS v3.1 base score is 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is a NULL pointer dereference (CWE-476) in the stdp4028_ge_b850v3_fw_remove() function within the megachips DRM bridge driver. Because the stdp2690 and stdp4028 bridges do not probe simultaneously, ge_b850v3_register() may never be called during probing; when the module is subsequently removed, drm_bridge_remove() is called on an uninitialized bridge object, resulting in a kernel KASAN-detected null-ptr-deref at address range [0x0000000000000008-0x000000000000000f]. The fix adds a check to verify that both bridges have been successfully probed before attempting deregistration (Red Hat CVE, Red Hat Bugzilla).

Successful exploitation causes a kernel general protection fault, leading to a system crash and denial of service. The vulnerability has no impact on confidentiality or integrity — only availability is affected (CVSS A:H, C:N, I:N). An attacker with local, low-privileged access who can trigger module unloading (e.g., via rmmod) on a system using the megachips DRM bridge driver could crash the kernel, potentially disrupting all services on the affected host (Red Hat CVE, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability requires local access with low privileges (PR:L) and no user interaction, limiting its attack surface primarily to users or processes with the ability to load and unload kernel modules. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

• Logs: Kernel log entries containing general protection fault or KASAN: null-ptr-deref associated with drm_bridge_remove or stdp4028_ge_b850v3_fw_remove; messages referencing i2c-core: driver [stdp2690-ge-b850v3-fw] unregistered immediately before a fault.
• Process/System: Unexpected kernel panic or system reboot following rmmod megachips_stdpxxxx_ge_b850v3_fw or equivalent module removal operations.
• Kernel Trace: Call trace in dmesg or /var/log/kern.log showing RIP: 0010:drm_bridge_remove+0x97/0x130 and stdp4028_ge_b850v3_fw_remove+0x34/0x60 [megachips_stdpxxxx_ge_b850v3_fw].

Patches are available for all affected stable kernel branches: 4.14.296, 4.19.262, 5.4.220, 5.10.150, 5.15.75, 5.19.17, and 6.0.3. Administrators should update to the patched kernel version for their respective branch as the primary remediation (Red Hat CVE, Red Hat Bugzilla). As a temporary workaround where patching is not immediately possible, avoid loading or unloading the megachips_stdpxxxx_ge_b850v3_fw kernel module, or disable it if it is not required for system operation. SUSE has also released kernel updates addressing this issue (SUSE Advisory).