CVE-2022-50647: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-50647 is a vulnerability in the Linux kernel's RISC-V architecture affecting port I/O string accessors (insb, outsb, etc.). The flaw causes these accessors to use the physical PCI port I/O address rather than the corresponding memory mapping, triggering kernel memory access faults when interacting with PCI devices such as PCIe parallel ports. It was disclosed on December 9, 2025, and affects Linux kernel versions on RISC-V platforms (confirmed on 6.0.0-rc2 and related stable branches). The CVSS v3.1 base score is 5.5 (Medium), exploitable locally with low privileges (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an incorrect implementation of port I/O string accessor macros in the RISC-V architecture layer of the Linux kernel (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer). The macros pass the raw physical PCI I/O port address directly to low-level accessors instead of offsetting it by PCI_IOBASE, which maps port I/O into the kernel's virtual address space. When a driver such as parport_pc attempts a string I/O operation (e.g., writing to a PCIe parallel port at address 0x1008), the kernel attempts to access that address as a virtual address, resulting in an "Unable to handle kernel access to user memory without uaccess routines" oops. The fix adds PCI_IOBASE to the physical address in the wrapper macros and corrects parenthesization for safe macro expansion (Red Hat Bugzilla).

Successful triggering of this vulnerability causes a kernel oops (crash) on RISC-V systems when a low-privileged local user interacts with affected PCI devices, resulting in a denial of service (system instability or crash). There is no confidentiality or integrity impact — the vulnerability is limited to availability. Systems most at risk are RISC-V platforms (e.g., SiFive HiFive Unmatched) with PCI devices that rely on port I/O string accessors, such as PCIe parallel port controllers (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating very low probability of exploitation in the near term. Exploitation requires local access with low privileges on a RISC-V system with an affected PCI device (Red Hat Advisory).

Update to a patched Linux kernel version that includes the fix for RISC-V port I/O string accessors (patches are available in stable kernel branches via the upstream kernel git repository). As an interim measure, limit local user access on RISC-V systems with PCI devices, particularly those using parallel port controllers. Monitor system logs for kernel oops messages referencing parport_pc_fifo_write_block_pio or "Unable to handle kernel access to user memory without uaccess routines" at low virtual addresses. Prioritize patching on RISC-V hardware with PCIe parallel port or similar PCI I/O devices (Red Hat Bugzilla, Red Hat Advisory).