CVE-2022-50635: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50635 is a null pointer dereference vulnerability in the Linux kernel's PowerPC kprobes subsystem, specifically within the arch_prepare_kprobe() function. The flaw was published on December 9, 2025, and affects the Linux kernel on PowerPC architectures. It is classified as medium severity with an EPSS score of 0.000180, indicating very low likelihood of exploitation in the wild (Red Hat).

The vulnerability is a null pointer dereference (CWE-476) in arch_prepare_kprobe() within the PowerPC kprobes implementation. When a kprobe is registered at an offset within a function (e.g., cmdline_proc_show+16), the code attempts to dereference a pointer that has not been validated, resulting in a kernel NULL pointer dereference at address 0x00000000. The crash manifests as a kernel oops with signal 11 (SIGSEGV) on PowerPC systems using Radix MMU, as shown in the kernel trace: NIP arch_prepare_kprobe+0x10c/0x2d0. Fixes were committed to the stable kernel tree via multiple patches (Red Hat).

Successful triggering of this vulnerability causes a kernel NULL pointer dereference, resulting in a kernel oops and potential system crash (denial of service). The impact is limited to availability — a local user with privileges to write to kprobe_events (typically root or a user with CAP_SYS_ADMIN) can crash the kernel on affected PowerPC systems. There is no evidence of confidentiality or integrity impact, and lateral movement or data exfiltration are not associated with this vulnerability (Red Hat).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution for CVE-2022-50635. The vulnerability requires local access and elevated privileges (root or CAP_SYS_ADMIN) to trigger, significantly limiting its attack surface. The EPSS score is 0.000180, reflecting a very low probability of exploitation. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat).

The fix is available in the Linux kernel stable tree via patches committed to multiple stable branches (referenced by commits 4eac4f6a86ae, 5fd1b369387c, 7f536a8cb62d, and 97f88a3d7231 on kernel.org). Users running PowerPC systems should update to a patched kernel version that includes these fixes. SUSE has issued kernel security updates addressing this CVE (e.g., SUSE advisories SUSE-2026-0263-1, SUSE-2026-0317-1, SUSE-2026-0350-1, SUSE-2026-0411-1). As a workaround, restricting access to the kprobes interface (e.g., via kernel.perf_event_paranoid or limiting /sys/kernel/debug/tracing/kprobe_events access) can reduce exposure (Red Hat, Linux Security).