CVE-2022-50502: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a vulnerability was identified in the /proc/pid/smaps_rollup functionality. The issue was introduced by commit 258f669e7e88 ("mm: /proc/pid/smaps_rollup: convert to single value seq_file") which caused a null-deref condition when there are no vma's in the task in show_smaps_rollup. This vulnerability has been assigned CVE-2022-50502 and was disclosed on October 4, 2025. The vulnerability affects the Linux kernel's memory management subsystem (NVD).

The vulnerability is classified as a null pointer dereference issue (CWE-476) in the Linux kernel's memory management subsystem. According to Red Hat's assessment, it has been assigned a CVSS v3.1 base score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), indicating a medium severity local vulnerability (Red Hat).

The vulnerability could lead to a system crash through a null pointer dereference when attempting to access the smaps_rollup file for a process with no virtual memory areas (VMAs). This primarily affects system stability and availability, with no direct impact on confidentiality or integrity (Red Hat).

The vulnerability has been addressed in the Linux kernel. Various Linux distributions have either patched their kernel versions or marked them as not affected. For instance, Red Hat Enterprise Linux 8 has deferred the fix, while versions 7 and 9 are marked as not affected (Red Hat).