CVE-2022-50439: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50439 is a race condition vulnerability in the Linux kernel's ASoC (Audio System on Chip) driver for the MediaTek MT8173 platform. The flaw occurs when an interrupt request (IRQ) is received before the driver's platform data (pdata) is fully initialized, causing the kernel to attempt a read from uninitialized memory. It affects Linux kernel versions 4.2 through 6.1.1 across multiple stable branches. The CVE was published on October 1, 2025, with NVD initial analysis completed January 21, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, NVD).

The root cause is a race condition (classified as NVD-CWE-noinfo due to insufficient information, but functionally a time-of-check/time-of-use issue) in the mt8173_afe_irq_handler function within sound/soc/mediatek/mt8173/. When a device does not come straight from reset, an IRQ can fire before the driver's pdata structure is populated, causing mt8173_afe_irq_handler to call regmap_read() on an uninitialized pointer. This results in a kernel read fault at virtual address 0x00000000000001e4, producing a call trace through regmap_read+0x1c/0x80 and mt8173_afe_irq_handler+0x40/0xf0. The fix defers IRQ enablement until after pdata is fully initialized (Feedly, NVD).

Successful exploitation causes a kernel panic and system crash, resulting in a complete loss of availability for the affected system. The impact is limited to availability — there is no confidentiality or integrity impact, as the vulnerability does not expose data or allow unauthorized writes. The affected scope is limited to systems running the MediaTek MT8173 audio driver (commonly ARM64 platforms such as Chromebooks using the MT8173 SoC), and there is no known potential for lateral movement or data exfiltration (Feedly, NVD).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The vulnerability requires local access with low privileges to trigger, limiting its attack surface. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

• Logs: Kernel log entries containing Unable to handle kernel read from unreadable memory at virtual address 00000000000001e4 during early boot.
• Logs: Call trace in dmesg or /var/log/kern.log referencing regmap_read+0x1c/0x80 and mt8173_afe_irq_handler+0x40/0xf0.
• System Behavior: Unexpected kernel panic or system reboot on MT8173-based devices during boot, particularly when the device was not freshly reset.

Apply the patched Linux kernel versions corresponding to your current branch: 5.4.229+ (for 4.2–5.4), 5.10.163+ (for 5.5–5.10), 5.15.86+ (for 5.11–5.15), 6.0.16+ (for 5.16–6.0), or 6.1.2+ (for 6.1). Six upstream patch commits are available in the kernel stable tree addressing this issue. No configuration-based workaround is documented; upgrading to a patched kernel version is the recommended remediation (Feedly, kernel.org patch).