CVE-2022-50319: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50319 is a denial-of-service vulnerability in the Linux kernel's CoreSight TRBE (Trace Buffer Extension) driver, caused by a mismatched CPU hotplug instance lifecycle. Specifically, cpuhp_state_add_instance() and cpuhp_state_remove_instance() are not called in pairs during module removal, leaving the cpuhp_step list non-empty and triggering a kernel warning. Affected kernel versions include 5.13 through 5.15.85, 5.16 through 6.0.15, and 6.1 through 6.1.1. It was publicly disclosed on September 15, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper resource cleanup (CWE-459: Incomplete Cleanup) in the arm_trbe_device_remove() function of the coresight-trbe kernel module. When the module is unloaded via rmmod coresight-trbe, the CPU hotplug instance node is not removed before the CPU hotplug state itself is torn down, violating the required pairing of cpuhp_state_add_instance() and cpuhp_state_remove_instance(). This triggers a kernel warning — "Error: Removing state 215 which has instances left" — and an associated call trace through __cpuhp_remove_state_cpuslocked. The attack vector is local and requires low privileges (e.g., the ability to unload kernel modules), with no user interaction needed (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation results in system instability and a denial-of-service condition on ARM64 systems equipped with the CoreSight TRBE hardware tracing subsystem. There is no confidentiality or integrity impact; the vulnerability exclusively affects availability. The kernel warning and improper state cleanup during module unloading can cause unexpected behavior or system instability, particularly on embedded or server ARM64 platforms using hardware trace capabilities (Red Hat Bugzilla, Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term. Exploitation requires local access with sufficient privileges to unload kernel modules, significantly limiting the attack surface (Red Hat Advisory).

The Linux kernel project has released patches addressing this vulnerability in the following stable versions: 5.15.86, 6.0.16, and 6.1.2. Users should update to one of these or any later kernel release. As a temporary workaround, administrators can avoid unloading the coresight-trbe module on affected systems and monitor kernel logs for warnings related to CPU hotplug state management. Patches are available via the upstream kernel stable tree (Red Hat Bugzilla, Kernel Patch 5.15, Kernel Patch 6.0, Kernel Patch 6.1).