CVE-2022-50828: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50828 is a stack-out-of-bounds read vulnerability in the Linux kernel's clk: zynqmp clock driver. The flaw occurs in the zynqmp_clock_probe function when handling clock names longer than 15 bytes via the Linux-ATF (ARM Trusted Firmware) SMC interface, which uses only 16 bytes of payload. Because the NULL terminator may not be received by Linux in such cases, a subsequent strncpy call reads beyond the stack buffer boundary. The vulnerability was published on December 30, 2025, and affects the Linux kernel (linux_kernel) on Xilinx ZynqMP/Versal platforms. CVSS scoring details are not yet fully established in public databases, and the CVE status is listed as Unknown (Feedly, VulDB).

The root cause is a missing explicit NULL terminator in the clock name buffer received from the ATF SMC interface (CWE-125: Out-of-bounds Read). The Linux-ATF interface passes clock names in a 16-byte SMC payload; if a clock name is exactly 16 bytes or longer, the NULL terminator is absent from the received buffer. When zynqmp_clock_probe subsequently calls strncpy on this buffer, KASAN detects a stack-out-of-bounds read at the address beyond the allocated stack region. The fix adds an explicit NULL character at the last byte of the received buffer before any string operations are performed. The KASAN report traces the fault through strncpy+0x30/0x68 called from zynqmp_clock_probe+0x238/0x7b8 during platform driver probe on Xilinx Versal vck190 hardware (Feedly).

Exploitation of this vulnerability can cause a kernel crash or undefined behavior due to out-of-bounds stack memory access during the clock driver initialization phase. The primary impact is on system availability, as the out-of-bounds read can trigger a kernel panic or KASAN fault, potentially preventing the system from booting or causing instability on affected Xilinx ZynqMP/Versal embedded platforms. Confidentiality impact is limited but possible if stack memory contents are inadvertently exposed through error reporting mechanisms (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50828. The vulnerability is triggered during kernel initialization (driver probe), meaning exploitation would require the ability to influence the ATF firmware's clock name data or physical access to the affected hardware. The EPSS score is 0.024% (very low), indicating minimal likelihood of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

The fix has been committed to the Linux kernel stable tree across multiple stable branches, with patches available at the official kernel.org git repository (commits 0a07b13af04d, 5dbfcf7b0803, bce41e4ac6f5, d9e2585c3bce, and d66fea97671f). Administrators running Linux on Xilinx ZynqMP or Versal platforms should update to a patched kernel version that includes the fix for clk: zynqmp. SUSE has also issued an advisory (SUSE-2026-0350-1) addressing this and related kernel issues. No configuration-based workaround is available; upgrading the kernel is the recommended remediation (Feedly, Linux Security).

Coverage of CVE-2022-50828 has been limited to automated vulnerability tracking services and Linux distribution security advisories, including SUSE and Red Hat CVE trackers. No notable researcher commentary or significant social media discussion has been identified for this vulnerability (Feedly).