CVE-2022-50421: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50421 is a use-after-free vulnerability in the Linux kernel's rpmsg (remote processor messaging) character device subsystem. The flaw arises from a double destruction of the default rpmsg endpoint, triggering a refcount underflow and use-after-free condition. It affects Linux kernel versions 5.18 through 5.19.17 (exclusive) and 6.0 through 6.0.3 (exclusive). The CVE was published on October 1, 2025, with NVD enrichment completed in December 2025. It carries a CVSS v3.1 base score of 7.8 (High) (Feedly, kernel.org patches).

The root cause is a use-after-free (CWE-416) in the rpmsg_chrdev_eptdev_destroy() function, which incorrectly destroys the default rpmsg endpoint. The default endpoint is already released by rpmsg_dev_remove() in rpmsg_core, so calling destroy again in rpmsg_chrdev_eptdev_destroy() results in a double-free, causing ept->refcount to underflow. The call trace at the time of the fault is: refcount_warn_saturate → virtio_rpmsg_destroy_ept → rpmsg_dev_remove. The vulnerability is locally exploitable with low privileges and can be triggered by stopping a remoteproc instance before closing the associated /dev/rpmsgX device file (Feedly).

Successful exploitation can result in high impacts to confidentiality, integrity, and availability of the affected system. A local attacker with low privileges could leverage the use-after-free condition to crash the kernel (denial of service) or potentially execute arbitrary code with kernel-level privileges, enabling full system compromise. The scope is limited to the local system, but kernel-level code execution could facilitate privilege escalation and lateral movement within a multi-tenant or containerized environment (Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. Exploitation requires local access with at least low-privilege credentials, limiting the attack surface.

• Logs: Kernel log entries containing refcount_t: underflow; use-after-free warnings, particularly in association with the rpmsg subsystem.
• Logs: Kernel call traces referencing refcount_warn_saturate, virtio_rpmsg_destroy_ept, or rpmsg_dev_remove.
• Process/Device: Unusual or premature termination of remoteproc processes while /dev/rpmsgX device files remain open.
• System Stability: Unexpected kernel panics or system crashes on systems using virtio-based rpmsg communication.

Update the Linux kernel to version 5.19.17 or later (for the 5.x branch) or 6.0.3 or later (for the 6.x branch), which include the fix preventing double destruction of the default rpmsg endpoint. Three upstream patches are available: patch 1, patch 2, and patch 3. As a workaround, restrict local user access to /dev/rpmsgX devices and ensure remoteproc instances are not stopped while rpmsg character device files remain open (Feedly).