CVE-2022-50675: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50675 is a vulnerability in the Linux kernel's arm64 Memory Tagging Extension (MTE) subsystem, specifically in the mte_sync_tags() function. The flaw causes PG_mte_tagged to be incorrectly set on pages that have not had their tags cleared or restored, leading to KASAN (Kernel Address Sanitizer) access faults when using CONFIG_KASAN_HW_TAGS=y. It was published on December 9, 2025, and affects the Linux kernel on arm64 architectures. The CVSS category is estimated as Medium, with an EPSS score of 0.000170 (Feedly).

The root cause is a logic error in the arm64 MTE tag synchronization path (CWE classification relates to improper state management). Prior to commit 69e3b846d8a7, mte_sync_tags() was only called for pte_tagged() entries (pages mapped with PROT_MTE), so using test_and_set_bit(PG_mte_tagged, &page->flags) was safe. After that commit — introduced to support guests enabling MTE without stage-2 mapping control — any page with a PTE resembling a swap or migration entry would have PG_mte_tagged set inadvertently. A subsequent page copy (e.g., during migration) would then copy tags to the destination page even if those tags were owned by KASAN, causing tag mismatches and invalid-access BUG reports such as BUG: KASAN: invalid-access in copy_page+0x10/0xd0 (Feedly). The fix moves the PG_mte_tagged bit setting to only occur when tags are actually cleared or restored, preventing spurious flag propagation.

Exploitation of this vulnerability can cause KASAN to report false-positive invalid-access faults on arm64 systems with CONFIG_KASAN_HW_TAGS=y, potentially destabilizing the kernel and leading to denial of service conditions. In virtualized environments where guests enable MTE without VMM-level PROT_MTE mappings, incorrect tag propagation during page migration can corrupt memory tag state, undermining the integrity guarantees that MTE provides. The primary impact is on system stability and the reliability of hardware memory tagging as a security mechanism, rather than direct privilege escalation or data exfiltration (Feedly).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2022-50675. The EPSS score is very low at 0.000170, indicating a minimal probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require a specific arm64 hardware environment with MTE support and CONFIG_KASAN_HW_TAGS=y enabled, significantly limiting the attack surface (Feedly).

The fix is available as upstream Linux kernel patches committed to the stable tree (commits 749e9fc18b1e, 918002bdbe43, and a8e5e5146ad0). Users should update to a patched kernel version that includes these fixes. SUSE has released updated kernel packages addressing this vulnerability (SUSE advisories SUSE-2026-0263-1, SUSE-2026-0317-1, and SUSE-2026-0411-1) (Linux Security). As a workaround, disabling CONFIG_KASAN_HW_TAGS or avoiding MTE-enabled guest configurations can reduce exposure, though upgrading to a patched kernel is the recommended remediation.