CVE-2022-50426: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50426 is a race condition vulnerability in the Linux kernel's remoteproc subsystem, specifically in the imx_dsp_rproc driver for NXP i.MX DSP remote processors. The flaw allows a workqueue to execute after the remoteproc has been stopped, accessing already-freed rpmsg device and endpoint resources and causing a kernel panic (crash). It affects Linux kernel versions 5.16 through 6.0.17 and 6.1.0 through 6.1.3. The CVE was published on October 1, 2025, with NVD initial analysis completed January 20, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a race condition (use-after-free scenario) in the imx_dsp_rproc_vq_work() function: the workqueue can be scheduled and execute after rproc_stop_subdevices() has already released the rpmsg device and virtual queue endpoint resources. When rproc_vq_interrupt() is subsequently called by the workqueue, it attempts to access these freed resources, triggering a kernel dump. The call trace shows the crash path through virtqueue_add_split → virtqueue_add_inbuf → rpmsg_recv_done → vring_interrupt → rproc_vq_interrupt → imx_dsp_rproc_vq_work. Additionally, calling flush_work inside imx_dsp_rproc_stop() is unsafe because rproc_stop_subdevices() has already freed the resources needed by rproc_vq_interrupt(). The fix adds mutex protection in imx_dsp_rproc_vq_work() to check the remoteproc state before invoking rproc_vq_interrupt(), and removes the unsafe flush_work call from the stop path (Red Hat Bugzilla).

Successful exploitation causes a kernel panic and system crash, resulting in a denial of service. An attacker with low-privileged local access on an affected system can trigger the race condition to crash the kernel, interrupting all running services and requiring a reboot. There is no confidentiality or integrity impact — the vulnerability is limited to availability (Red Hat Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability requires local access with low privileges to trigger, limiting its attack surface. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat Advisory).

Update the Linux kernel to version 6.0.18 or later (for the 6.0.x branch) or 6.1.4 or later (for the 6.1.x branch). Patch commits are available in the stable kernel tree. Systems running kernel versions 5.16 through 6.0.17 or 6.1.0 through 6.1.3 with NXP i.MX DSP remoteproc support should prioritize patching. No configuration-based workaround is documented; upgrading to a fixed kernel version is the recommended remediation (Red Hat Bugzilla, kernel.org patch 1, kernel.org patch 2, kernel.org patch 3).