CVE-2022-50649: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50649 is an out-of-bounds read vulnerability in the Linux kernel's power supply subsystem, specifically in the adp5061_get_chg_type() function of the ADP5061 battery charger driver. The flaw arises because ADP5061_CHG_STATUS_1_CHG_STATUS is masked with 0x07 (allowing values 0–7), but the adp5061_chg_type array has only 4 elements, enabling reads up to 4 elements beyond the array boundary. It was published on December 9, 2025, and affects the Linux kernel across multiple stable branches. The EPSS score is approximately 0.024% (very low), and the vulnerability is estimated as Medium severity (Feedly, CIRCL).

The root cause is an out-of-bounds read (CWE-125) in the adp5061_get_chg_type() function within drivers/power/supply/adp5061.c. The status register field ADP5061_CHG_STATUS_1_CHG_STATUS is masked with 0x07, producing an index range of 0–7, but the lookup array adp5061_chg_type[] only contains 4 entries. When the hardware reports a status value of 4–7, the code reads memory beyond the array's bounds. Exploitation would require local access to a system with the ADP5061 charger hardware present and the driver loaded. Patches have been committed to multiple stable kernel trees (Feedly, EUVD).

Successful exploitation of this vulnerability could result in the kernel reading arbitrary memory beyond the adp5061_chg_type[] array, potentially exposing sensitive kernel memory contents (confidentiality impact) or causing unpredictable behavior depending on what data is read and how it is used. In practice, the impact is limited because the vulnerability is in a hardware-specific driver that only activates on systems with the ADP5061 charger IC, and exploitation requires local access. There is no known path to privilege escalation or remote code execution from this flaw alone (Feedly).

The fix has been backported to multiple Linux stable kernel branches. Patched versions include: 4.19.262, 5.4.220, 5.10.150, 5.15.75, 5.19.17, 6.0.3, and 6.1 (mainline). Users should update to a kernel version that includes the fix for their respective stable branch. SUSE has also issued kernel security updates addressing this CVE (Feedly, Linux Security).