CVE-2022-50623: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50623 is an integer overflow vulnerability in the Linux kernel's FPGA subsystem, specifically in the dfl_feature_ioctl_set_irq() function. The flaw arises because the expression hdr.count * sizeof(s32) can overflow on 32-bit systems, leading to memory corruption. It was published on December 8, 2025, and affects Linux kernel versions from 5.9 up to (but not including) the patched stable releases. Fixed versions include kernel 5.10.150, 5.15.75, 5.19.17, 6.0.3, and 6.1. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, ENISA EUVD).

The root cause is an integer overflow (CWE-190) in the dfl_feature_ioctl_set_irq() function within the Linux kernel's FPGA Device Feature List (DFL) driver. On 32-bit systems, the multiplication hdr.count * sizeof(s32) can wrap around, producing a smaller-than-expected allocation size, which subsequently leads to a heap buffer overflow or memory corruption when data is written beyond the allocated region. The fix replaces the raw multiplication with the kernel's array_size() helper, which performs overflow-safe size calculations. Exploitation requires local access with low privileges, as the vulnerable code path is reachable via an ioctl call on an FPGA device node (Red Hat CVE, ENISA EUVD).

Successful exploitation could allow a low-privileged local attacker to corrupt kernel memory, potentially causing system instability or a denial of service (kernel crash). The primary impact is on availability, as memory corruption in kernel space can lead to unpredictable system behavior or crashes; confidentiality and integrity impacts are assessed as none in the CVSS scoring. The vulnerability is limited to 32-bit systems with FPGA hardware using the DFL driver framework (Red Hat CVE, ENISA EUVD).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (ENISA EUVD). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term (Feedly). Exploitation is further constrained by the requirement for local access, low-privilege credentials, and the presence of 32-bit hardware with FPGA DFL devices.

The recommended remediation is to update to a patched Linux kernel version: 5.10.150, 5.15.75, 5.19.17, 6.0.3, or 6.1 and later. Vendor-specific patches are available from Red Hat and SUSE for their respective distributions. As a workaround, restricting local user access to FPGA device nodes (e.g., via udev rules or file permissions) and preferring 64-bit systems can reduce exposure. Organizations should apply kernel updates through their standard patch management process (Red Hat CVE, ENISA EUVD).