CVE-2022-50614: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50614 is a denial-of-service vulnerability in the Linux kernel's misc/pci_endpoint_test driver, where dma_map_single() is called with a zero-length mapping, triggering a kernel panic (BUG) in swiotlb_tbl_map_single. The vulnerability affects the Linux kernel and was publicly disclosed on December 8, 2025, with an upstream advisory published via the linux-cve-announce mailing list. It carries a CVSS v3.1 base score of 7.0 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is improper input validation (CWE-20) in the pci_endpoint_test_copy(), pci_endpoint_test_write(), and pci_endpoint_test_read() functions within the drivers/misc/pci_endpoint_test.c driver. When a user-supplied payload length of zero is passed via an ioctl call, dma_map_single() is invoked with a zero-length buffer, which is explicitly prohibited and causes the kernel to BUG at kernel/dma/swiotlb.c:624. The fix adds a payload length check before the DMA mapping call to reject zero-length requests early. The attack vector is local, requiring low privileges (e.g., access to the PCI endpoint test ioctl interface), and the attack complexity is rated High (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation causes a kernel panic, resulting in a complete system crash and denial of service. The CVSS scoring also reflects high confidentiality and integrity impacts, suggesting potential for broader kernel memory corruption in certain configurations, though the primary observed impact is availability loss. Systems using the pci_endpoint_test kernel module — particularly embedded or development platforms such as Renesas Salvator-X boards — are most directly at risk (Red Hat Bugzilla, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is very low at approximately 0.018%, reflecting minimal exploitation probability. The attack requires local access with low privileges and high complexity, further limiting practical exploitability (Red Hat CVE, Feedly).

1. Gain local access: Obtain a low-privilege local account on a Linux system with the pci_endpoint_test kernel module loaded.
2. Identify the PCI endpoint test device: Locate the character device exposed by the pci_endpoint_test driver (typically accessible via /dev/pci-endpoint-test.*).
3. Issue a crafted ioctl: Use the pcitest utility or a custom program to send an ioctl request (e.g., PCITEST_COPY, PCITEST_WRITE, or PCITEST_READ) with a payload length of zero.
4. Trigger kernel panic: The zero-length value is passed to dma_map_single(), which calls into swiotlb_tbl_map_single() and triggers a kernel BUG, crashing the system (Red Hat Bugzilla).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing kernel BUG at kernel/dma/swiotlb.c:624! followed by an Internal error: Oops - BUG with a call trace including swiotlb_tbl_map_single, swiotlb_map, dma_map_page_attrs, and pci_endpoint_test_ioctl.
• Process: Presence of the pcitest process (PID visible in crash logs) issuing ioctl calls to the PCI endpoint test driver immediately before a system crash.
• System: Unexpected system reboots or kernel panics on systems with the pci_endpoint_test module loaded, particularly on embedded or development hardware (Red Hat Bugzilla).

Apply the upstream Linux kernel patch that adds a zero-length payload check in pci_endpoint_test_copy(), pci_endpoint_test_write(), and pci_endpoint_test_read() before calling dma_map_single(). Patches are available in the stable kernel tree (commits 0df206bdc620, 6c01739c2aba, 8e30538eca01, 279116cb0bc5). As a workaround, restrict access to the PCI endpoint test ioctl interface using file permissions or security modules such as SELinux, and unload the pci_endpoint_test module if it is not required in production environments (Red Hat Bugzilla, Red Hat CVE).