CVE-2022-50768: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50768 is a vulnerability in the Linux kernel's scsi: smartpqi driver related to incorrect device count handling for multi-actuator drives, which can cause kernel panics. The flaw was published on December 24, 2025, and affects Linux kernel versions from the initial commit (1da177e4c3f4) up to the fixes introduced in stable releases 6.0.16, 6.1.2, and 6.2. The CVSS base score has not been formally assigned (estimated Medium severity by Feedly), and the EPSS score is approximately 0.017% (Feedly, EUVD).

The root cause is an incorrect device count calculation in the smartpqi SCSI driver when handling multi-actuator storage devices — drives that expose multiple logical actuators as separate SCSI targets. When such a device is removed, the driver miscounts the number of associated devices, leading to an out-of-bounds or invalid memory access that triggers a kernel panic (consistent with CWE-131: Incorrect Calculation of Buffer Size or a related memory management error). The fix was applied via three stable-tree commits targeting kernel versions 6.0.16, 6.1.2, and 6.2 (Feedly, EUVD). No public proof-of-concept exploit code is known.

Successful triggering of this vulnerability results in a kernel panic, causing a complete system crash and denial of service on affected Linux hosts. The impact is limited to availability — there is no known confidentiality or integrity impact, and the vulnerability does not enable code execution or privilege escalation. Systems using HPE Smart Array controllers managed by the smartpqi driver with multi-actuator drives attached are the primary affected assets (Feedly).

Apply the upstream Linux kernel fixes included in stable releases 6.0.16, 6.1.2, and 6.2 or later. SUSE has also issued kernel security advisories (SUSE-2026:0263-1 and SUSE-2026:0317-1) that include this fix for affected SUSE Linux Enterprise distributions. Administrators running systems with HPE Smart Array controllers and multi-actuator drives should prioritize updating to a patched kernel version (Feedly, Linux Security SUSE Advisory 1, Linux Security SUSE Advisory 2).