CVE-2022-50423: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50423 is a use-after-free vulnerability in the Linux kernel's ACPICA subsystem, specifically within the acpi_ut_copy_ipackage_to_ipackage() function. It affects a wide range of Linux kernel versions spanning from 3.10.55 through 6.1 (before 6.1.2), including multiple stable branches. The vulnerability was publicly disclosed on October 1, 2025, and received a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-416 (Use After Free). The bug was introduced by commit 8aa5e56eeb61, which added a acpi_ut_remove_reference() call in acpi_ut_copy_ipackage_to_ipackage() to fix a memory leak in acpi_ut_copy_iobject_to_iobject(). However, when acpi_ut_walk_package_tree() fails during package copying, the acpi_operand_object is freed inside acpi_ut_copy_ipackage_to_ipackage(), and then freed again by the caller acpi_ut_copy_iobject_to_iobject(), resulting in a double-free / use-after-free condition. The fix removes the erroneous acpi_ut_remove_reference() call from acpi_ut_copy_ipackage_to_ipackage(), delegating memory cleanup responsibility to the caller. Exploitation requires local access with low privileges, triggered during ACPI AML parsing (e.g., during module loading) (Red Hat Advisory).

A local attacker with low-privileged access could exploit this vulnerability to cause memory corruption, potentially leading to arbitrary code execution in kernel context, system crashes (denial of service), or unauthorized access to kernel memory. The vulnerability affects confidentiality, integrity, and availability at the HIGH level, and given its kernel-level nature, successful exploitation could result in full system compromise or privilege escalation (Red Hat Advisory).

There is no public proof-of-concept exploit or evidence of in-the-wild exploitation for CVE-2022-50423 at this time (Red Hat Advisory). The EPSS score is approximately 0.033% (0.000330), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with at least low-privilege credentials, limiting the attack surface compared to remotely exploitable vulnerabilities.

Patches are available across multiple stable Linux kernel branches. Administrators should update to the following fixed versions or later: 3.11, 3.13, 3.15, 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, or 6.1.2. Patch commits are available on kernel.org for each affected branch. As a compensating control, limiting local user access to systems running vulnerable kernel versions reduces exploitation risk. SUSE and openSUSE have also released updated kernel packages addressing this issue (Red Hat Advisory, SUSE Advisory, openSUSE Advisory).

The vulnerability was picked up by Linux security news outlets and vendor advisory channels, including SUSE and openSUSE, which issued kernel update advisories addressing CVE-2022-50423 among other issues. No notable independent researcher commentary or significant social media discussion has been observed for this specific CVE (SUSE Advisory, openSUSE Advisory).