CVE-2022-50721: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50721 is a kernel panic vulnerability in the Linux kernel's dmaengine: qcom-adm driver caused by a violation of the prep_slave_sg calling convention. The qcom-adm driver incorrectly returns an error pointer on failure instead of NULL, which causes dependent drivers such as nandc (NAND controller) to misinterpret the result as success and subsequently trigger a kernel panic. The vulnerability affects Linux kernel versions from commit 5c9f8c2dbdbe up to the fixes introduced in stable releases 5.19.17, 6.0.3, and 6.1. It was published on December 24, 2025, and carries an estimated CVSS severity of Medium with an EPSS score of approximately 0.017% (Feedly, EUVD).

The root cause is an improper return value in the qcom-adm DMA engine driver's implementation of prep_slave_sg (CWE-393: Return of Wrong Status Code). The Linux kernel DMA engine API mandates that prep_slave_sg return NULL on error; however, qcom-adm returns an ERR_PTR value instead. The nandc (NAND controller) driver, which calls device_prep_slave_sg, only checks whether the returned pointer is non-NULL — it does not check for IS_ERR(). As a result, the error pointer is treated as a valid descriptor, leading to a kernel panic when the invalid pointer is subsequently dereferenced. The fix involves modifying qcom-adm to return NULL and emit an error log on failure, aligning it with the expected calling convention (Feedly).

The primary impact of this vulnerability is a kernel panic (denial of service), causing the affected Linux system to crash. Systems using Qualcomm ADM DMA hardware (common in Qualcomm-based embedded and mobile platforms) with NAND flash storage are most at risk. There is no evidence of confidentiality or integrity impact; the vulnerability is limited to availability, specifically causing an unrecoverable system crash when the affected code path is triggered (Feedly).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2022-50721. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. Triggering the vulnerability requires the affected hardware (Qualcomm ADM DMA controller) and a code path that invokes device_prep_slave_sg via the nandc driver, limiting the exploitable surface to specific embedded/mobile hardware configurations (Feedly).

The fix has been backported to stable Linux kernel releases 5.19.17, 6.0.3, and 6.1. Users should update to these or later kernel versions. The patches are available in the upstream stable kernel repository at the following commits: 5653bd0200944e5803fa8e32dc36aa49931312f9, 9a041174c58a226e713f6cebd41eccec7a5cfa72, and b9d2140c3badf4107973ad77c5a0ec3075705c85. No configuration-based workaround is available; upgrading the kernel is the only remediation (Feedly, kernel.org patches).