CVE-2022-50636: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50636 is a vulnerability in the Linux kernel's PCI subsystem where pci_device_is_present() incorrectly handles Virtual Functions (VFs) by reading Vendor and Device IDs that always return 0xffff for VFs, causing the function to incorrectly report the device as absent. This logic error affects systems using SR-IOV (Single Root I/O Virtualization) with virtio devices. The vulnerability was formally published on December 9, 2025, though the underlying bug originates from 2022-era kernel code. Affected versions span from the initial kernel commit through multiple stable branches, with fixes backported to Linux 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.87, 6.0.18, 6.1.4, and 6.2. The CVSS estimate is Medium severity with a base score of 0.0 per ENISA data, and an EPSS score of 0.024% (Feedly).

The root cause is an incorrect device presence check in pci_device_is_present() (related to CWE-754: Improper Check for Unusual or Exceptional Conditions). For SR-IOV Virtual Functions, reading the Vendor ID and Device ID configuration space registers always returns 0xffff, which the function misinterprets as the device being absent. The fix modifies the function to always check the Physical Function (PF) using pci_physfn() instead of the VF directly. The bug manifests when a virtio I/O operation is in progress and the driver is unbound or sriov_numvfs is set to 0: pci_device_is_present(VF) returns false, triggering virtio_break_device(), which breaks the virtual queue and causes vring_interrupt() to skip the vq.callback() that would have completed the I/O via virtblk_done() (Feedly).

The primary impact is an availability issue: virtio I/O operations (e.g., block device I/O via virtio_blk) can hang indefinitely when SR-IOV VFs are removed or disabled while I/O is in progress, resulting in tasks stuck in uninterruptible sleep (state D) and potential system instability. The hang occurs because the broken virtual queue prevents completion of pending I/O operations, which can cascade into broader system unavailability for workloads relying on virtio block or network devices in virtualized environments. There is no known confidentiality or integrity impact; the vulnerability is limited to denial-of-service conditions on affected hosts (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution for CVE-2022-50636. The vulnerability requires local access to trigger the condition (e.g., writing to /sys/.../sriov_numvfs while I/O is in progress), limiting its exploitability to privileged local users or administrators. The EPSS score is approximately 0.024%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

Apply the kernel patches backported to the following stable versions: 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.87, 6.0.18, 6.1.4, and 6.2. The fix modifies pci_device_is_present() to use pci_physfn() so that VF presence is determined by checking the Physical Function. SUSE Linux has issued advisories (SUSE-2026-0263, SUSE-2026-0317, SUSE-2026-0411) incorporating this fix. As a workaround, avoid disabling SR-IOV (sriov_numvfs=0) or unbinding virtio drivers while active I/O is in progress on affected VFs (Feedly, Linux Security SUSE Advisory).