CVE-2022-50332: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50332 is a Linux kernel vulnerability in the video/aperture subsystem where sysfb_disable() is not called before removing PCI devices in aperture_remove_conflicting_pci_devices(). This omission allows the simpledrm driver to bind to simple-framebuffer devices after a hardware driver has already taken over the hardware, causing both drivers to interfere with each other and producing undefined behavior. The vulnerability affects Linux kernel versions 6.0.3 through 6.0.5 (i.e., versions starting from 6.0.3 and before 6.0.6) and was publicly disclosed on September 15, 2025. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a flawed stable-branch backport: commit 5e0137612430 ("video/aperture: Disable and unregister sysfb devices via aperture helpers") was backported from the v6.0-rc1 mainline to stable v6.0.3, but the backport omitted a necessary change to aperture_remove_conflicting_pci_devices() that calls sysfb_disable() prior to PCI device removal. In mainline, the function does not exist due to a broader patch series reworking fbdev framebuffer ownership, so mainline is unaffected. The missing call means simpledrm can concurrently access framebuffer hardware already claimed by a dedicated hardware driver, leading to RCU (Read-Copy-Update) stalls, modesetting errors, and undefined kernel behavior (CWE classification consistent with improper resource management). Exploitation requires local access with low privileges (Red Hat Bugzilla).

Successful triggering of this vulnerability results in a Denial of Service (DoS) condition on affected systems. Concurrent driver interference between simpledrm and the hardware graphics driver can cause RCU stalls, system hangs, graphics rendering failures, and undefined kernel behavior. There is no confidentiality or integrity impact; the vulnerability is limited to availability, affecting the stability of the graphics subsystem and potentially the entire system (Red Hat Advisory, Red Hat Bugzilla).

The fix is to update the Linux kernel to version 6.0.6 or later, which includes the corrected aperture_remove_conflicting_pci_devices() function that properly calls sysfb_disable() before removing PCI devices. The upstream patch is available at the kernel stable repository (commit 25a6688f27ff54f97adf7cce1d7e18c38bf51eb4). Users on affected stable kernel versions (6.0.3–6.0.5) should apply vendor-provided kernel updates as soon as available and monitor system stability, particularly after graphics driver initialization (Red Hat Bugzilla, Kernel Patch).