CVE-2022-50812: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-50812 is a Linux kernel vulnerability related to an incorrect compiler feature restriction in the CONFIG_ZERO_CALL_USED_REGS security hardening option. A bug in clang's implementation of -fzero-call-used-regs (present in clang ≤ 15.0.6) can result in NULL pointer dereferences when the kernel is compiled with this option enabled using an affected clang version. The vulnerability affects the Linux kernel across a broad range of versions prior to the fixes backported into stable releases 5.15.86, 6.0.16, 6.1.2, and mainline 6.2. It was published on December 30, 2025, and carries an EPSS score of approximately 0.018% (very low), with no CVSS base score assigned (Feedly, EUVD).

The root cause is a defect in clang's code generation for the -fzero-call-used-regs compiler flag, which is intended to zero out CPU registers used by a function before returning — a security hardening measure to reduce data leakage. When a Linux kernel built with CONFIG_ZERO_CALL_USED_REGS uses clang version 15.0.6 or earlier, the compiler's faulty implementation can produce code that dereferences NULL pointers, leading to kernel crashes. The fix restricts CONFIG_CC_HAS_ZERO_CALL_USED_REGS to either a supported GCC version or clang newer than 15.0.6 (i.e., 15.0.7+ or 16.0.0+, both of which contain the upstream clang fix). This is a build-time configuration issue rather than a runtime input-handling flaw, and it is classified under improper handling of compiler-generated code (related to CWE-476: NULL Pointer Dereference) (Feedly, Linux Kernel Stable).

Exploitation of this vulnerability can cause a NULL pointer dereference within the Linux kernel, resulting in a kernel panic and system crash — a denial of service condition. Because this is a kernel-level crash triggered by faulty compiled code, it affects the availability of any system running a kernel built with the affected clang version and the CONFIG_ZERO_CALL_USED_REGS option enabled. There is no direct evidence of confidentiality or integrity impact, and the vulnerability is not exploitable remotely in the traditional sense — it manifests as a stability defect in kernels compiled under specific conditions (Feedly, EUVD).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50812. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Its EPSS score is approximately 0.018%, reflecting a very low probability of exploitation in the near term. The issue is a build-time defect that only affects systems compiled with a specific vulnerable clang version and a non-default kernel configuration option, significantly limiting its practical attack surface (Feedly).

The Linux kernel stable team has released patches addressing this issue in versions 5.15.86, 6.0.16, 6.1.2, and 6.2 (mainline). The fix restricts CONFIG_CC_HAS_ZERO_CALL_USED_REGS so it is only enabled when using a supported GCC version or clang newer than 15.0.6. Administrators should upgrade to a patched kernel version or, as a workaround, ensure kernels are not compiled with CONFIG_ZERO_CALL_USED_REGS enabled when using clang 15.0.6 or earlier. Upgrading the clang toolchain to version 15.0.7 or 16.0.0+ also resolves the underlying compiler defect (Linux Kernel Stable, EUVD).