CVE-2022-50756: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50756 is a memory corruption vulnerability in the Linux kernel's NVMe-PCI driver caused by an incorrect mempool allocation size calculation for Physical Region Page (PRP) entries. The flaw was formally published on December 24, 2025, though the underlying fix was backported to stable kernel branches in early 2023. Affected Linux kernel versions include those prior to 5.10.163, 5.15.87, 6.0.17, 6.1.3, and 6.2. The CVSS estimate is Medium severity, with an EPSS score of approximately 0.018% (Feedly, Red Hat Bugzilla).

The root cause is an incorrect unit conversion in the NVMe-PCI driver's PRP list size calculation (CWE-131: Incorrect Calculation of Buffer Size). The driver failed to convert the maximum I/O size to bytes before dividing by the page size to determine the worst-case number of PRP entries, causing it to underestimate the required number of PRP lists — rounding to 1 when 2 may be needed. In the worst-case scenario (a 4MB transfer split across exactly 127 physical segments on a queue without Scatter-Gather List support), the driver writes PRP list data beyond the end of the mempool-allocated buffer, resulting in out-of-bounds memory corruption. This bug was observed in practice via the kernel's KFENCE (Kernel Electric Fence) memory safety tool (Feedly).

Successful triggering of this vulnerability results in kernel-level memory corruption, which can cause system instability, kernel panics, or crashes, impacting availability. In theory, memory corruption at the kernel level could also be leveraged for privilege escalation or unauthorized access to kernel memory, affecting confidentiality and integrity, though no such exploitation has been demonstrated. The impact is limited to systems using NVMe storage over PCIe without SGL support and handling specific I/O patterns (Feedly).

The fix has been incorporated into the following stable Linux kernel versions: 5.10.163, 5.15.87, 6.0.17, 6.1.3, and 6.2. Administrators should update to one of these or any later patched release through their Linux distribution's official update channels. No configuration-based workaround is available; kernel upgrade is the only remediation. Monitoring system logs for unexpected kernel panics or KFENCE reports related to NVMe operations may help detect triggering of this condition on unpatched systems (Feedly, Red Hat Bugzilla).