CVE-2022-50778: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50778 is a vulnerability in the Linux kernel's FORTIFY_SOURCE implementation, specifically in the __compiletime_strlen() function when used alongside CONFIG_UBSAN_LOCAL_BOUNDS (UBSAN_BOUNDS_LOCAL). The flaw causes a runtime panic due to an out-of-bounds array access triggered when __builtin_object_size() returns the maximum size of a set of possible string values rather than the actual runtime string size, leading to an access beyond the end of a shorter string. It was published on December 24, 2025, and affects the Linux kernel. The CVSS category is estimated as Medium (Feedly).

The root cause is an improper handling of __builtin_object_size() semantics within __compiletime_strlen() (CWE-125: Out-of-bounds Read). When CONFIG_FORTIFY_SOURCE=y and CONFIG_UBSAN_LOCAL_BOUNDS=y are both enabled, __compiletime_strlen() uses __builtin_object_size(str, 1) to determine string length, but for control-flow-dependent strings (e.g., those assigned in a switch statement), the compiler returns the maximum possible object size across all branches. This causes the subsequent NUL-termination check to access memory beyond the end of shorter strings at runtime, triggering a UBSAN local bounds fault. The issue was observed in hidinput_allocate() during Android CTS testing (android.hardware.input.cts.tests) (Feedly). Patches are available in the Linux kernel stable tree (Kernel Git).

Exploitation of this vulnerability results in a kernel runtime panic (denial of service) on systems with both CONFIG_FORTIFY_SOURCE and CONFIG_UBSAN_LOCAL_BOUNDS enabled. The out-of-bounds read in the FORTIFY string-length check can crash the kernel when processing HID input device initialization, affecting availability. There is no known direct path to privilege escalation or data exfiltration from this specific bug, making the primary impact a local denial of service on affected kernel configurations (Feedly).

Apply the upstream Linux kernel patches that fix __compiletime_strlen() to correctly handle control-flow-dependent strings under UBSAN_LOCAL_BOUNDS. The fixes are available in the Linux stable tree at the following commits: 5d59ad2, d07c0acb, and ed42391. As a temporary workaround, disabling CONFIG_UBSAN_LOCAL_BOUNDS or CONFIG_FORTIFY_SOURCE in the kernel build configuration will prevent the panic, though this reduces security hardening. Distributions shipping kernels with both options enabled (common in Android and some hardened Linux builds) should prioritize applying the patch (Feedly).