CVE-2022-50674: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-50674 is a NULL pointer dereference vulnerability in the Linux kernel's RISC-V vDSO subsystem, specifically in the vdso_join_timens() function. The flaw is triggered when a vfork() system call is made in a time namespace context, causing a kernel oops due to an invalid memory access at a user-space address. It was published on December 9, 2025, and affects the Linux kernel (vendor: linux, product: kernel). The vulnerability carries an estimated CVSS severity of Medium and an EPSS score of 0.000170 (Feedly, Tenable).

The root cause is a NULL pointer dereference (CWE-476) in the vdso_join_timens() function within the RISC-V vDSO (virtual Dynamic Shared Object) implementation. When a process calls vfork() within a time namespace, the function attempts to access a memory structure that has not been properly initialized or mapped, resulting in a kernel access to user memory without uaccess routines at virtual address 0x0000000000000020. The kernel oops trace shows the fault occurring at vdso_join_timens+0xd2/0x110 on RISC-V hardware (tested on riscv-virtio/QEMU). Fixes are available via stable kernel commits (Kernel Git, Kernel Git, Kernel Git).

Successful exploitation of this vulnerability causes a kernel oops (denial of service) on RISC-V systems running an affected Linux kernel version when vfork() is used within a time namespace. The primary impact is an availability loss — the kernel crash can destabilize or halt the affected system. There is no evidence of confidentiality or integrity impact, and the vulnerability does not appear to enable privilege escalation or remote code execution (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50674. The EPSS score is very low at 0.000170, indicating a minimal probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It can be triggered locally by a user with the ability to create time namespaces and execute vfork(), which is a relatively constrained attack surface (Feedly, Tenable).

Apply the upstream Linux kernel patches that fix the NULL dereference in vdso_join_timens() for RISC-V. The relevant stable kernel commits are a8616d2dc193, df30c4feba51, and f2419a6fbb4c. Users running RISC-V Linux systems should update to a patched kernel version as soon as their distribution makes it available. As a temporary workaround, restricting unprivileged access to time namespaces (e.g., via user.max_time_namespaces sysctl) can reduce exposure (Kernel Git, Kernel Git, Kernel Git).