CVE-2022-50785: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-50785 is a use-after-free vulnerability in the Linux kernel's FSI OCC (On-Chip Controller) driver (drivers/fsi/fsi-occ.c). The flaw arises because the driver fails to properly manage device reference counts when a file descriptor is open, and does not adequately protect the device buffer during concurrent access. It was published to the NVD on December 30, 2025, despite carrying a 2022 CVE identifier, indicating a backlog assignment. No CVSS score has been assigned by NVD at this time (NVD).

The root cause is a use-after-free condition (CWE-416) in the Linux kernel's fsi: occ subsystem. Specifically, the driver's open and close file operations did not call get_device/put_device to increment/decrement the device reference count, meaning the underlying device object could be freed while a file descriptor referencing it remained open. Additionally, the submit function lacked a lock around access to the device buffer and did not validate the buffer pointer before use, creating a race condition where a freed buffer could be dereferenced. The fix introduces proper reference counting in open/close and adds locking with a NULL check in the submit path (NVD, kernel.org patch 1, kernel.org patch 2).

Successful exploitation of this vulnerability could allow a local attacker or unprivileged process with access to the OCC device node to trigger a use-after-free condition, potentially leading to kernel memory corruption, system crashes (denial of service), or privilege escalation depending on the memory layout at the time of exploitation. The impact is limited to systems that expose the FSI OCC interface, which is primarily found in IBM POWER-based hardware platforms using the FSI bus for on-chip controller communication (NVD).

No public proof-of-concept exploit code has been identified for CVE-2022-50785, and there is no evidence of in-the-wild exploitation. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to a system with the FSI OCC driver loaded and the relevant device node accessible, significantly limiting the attack surface (NVD).

The Linux kernel maintainers have issued patches addressing this vulnerability across multiple stable branches, referenced by commits 1d5ad0a874ddfcee9f932f54b1d34cbe8b9ddcfe, 3593e8efc9f0dac6be70bd5c964eadaa86bf2713, and d3e1e24604031b0d83b6c2d38f54eeea265cfcc0 on kernel.org. Administrators should update to a patched kernel version that includes these commits. As a workaround on systems that do not require FSI OCC functionality, restricting access to the OCC device node or blacklisting the fsi-occ kernel module can reduce exposure (NVD, kernel.org patch 3).