CVE-2022-50620: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-50620 is a NULL pointer dereference vulnerability in the Linux kernel's F2FS (Flash-Friendly File System) subsystem. The flaw exists in the error path handling of the discard control context (dcc->f2fs_issue_discard), where the discard thread pointer is not properly invalidated before f2fs_stop_discard_thread() attempts to call kthread_stop() on it. The vulnerability was published on December 8, 2025, and affects the Linux kernel. It carries an EPSS score of approximately 0.018% (low), indicating limited exploitation probability (Feedly).

The root cause is a NULL pointer dereference (CWE-476) in fs/f2fs/segment.c. During an error path when mounting an F2FS filesystem, dcc->f2fs_issue_discard may not be properly set to NULL after a failed thread initialization. When f2fs_stop_discard_thread() is subsequently called during superblock teardown (e.g., via kill_f2fs_super()), it invokes kthread_stop() on the uninitialized or NULL pointer, triggering a kernel panic. The issue was identified via Syzbot fuzzing, which produced a reproducible NULL pointer dereference trace through the kernel's refcount and kthread subsystems (Feedly). Fixes are available as stable kernel patches at multiple git.kernel.org commit references.

Successful triggering of this vulnerability causes a kernel NULL pointer dereference, resulting in a kernel panic and system crash — a complete denial of service of the affected host. Because the flaw is in the F2FS filesystem error path, it is most likely to be triggered locally by a user or process with the ability to mount a crafted or malformed F2FS image. There is no evidence of confidentiality or integrity impact; the primary consequence is availability loss (Feedly).

No public exploit code or proof-of-concept has been identified for CVE-2022-50620. The vulnerability was discovered through Syzbot automated kernel fuzzing and is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting very low likelihood of active exploitation. There is no known threat actor attribution or in-the-wild exploitation (Feedly).

The fix has been applied to the Linux kernel stable tree via multiple commits (e.g., 865bb7b5a7de, 91586ce0d39a, a3e517a6ba69, ae6c960a82c5). Users should update to a patched kernel version that includes these fixes. Linux distribution maintainers (e.g., Debian, Ubuntu, Red Hat) are expected to backport the fix into their respective stable kernel packages. As a workaround, avoiding the use of F2FS on untrusted or potentially malformed storage devices reduces exposure (Feedly).