CVE-2022-50842: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50842 is a NULL pointer dereference vulnerability in the Linux kernel's DRM virtio graphics driver (drm/virtio). The flaw occurs when userspace passes a VRAM buffer object (BO) where a shared memory (shmem) BO is required during a 2D transfer operation, leading to a kernel NULL dereference. It affects the Linux kernel across multiple stable branches, with fixes backported to versions 5.10.150, 5.15.75, 5.19.17, 6.0.3, and 6.1. The CVE was published on December 30, 2025, and carries an estimated CVSS severity of Medium (Feedly, EUVD).

The root cause is a missing input validation check (CWE-476: NULL Pointer Dereference) in the drm/virtio subsystem of the Linux kernel. When a 2D buffer object transfer is initiated, the code assumes the BO is always a shmem (shared memory) type; if userspace instead supplies a VRAM BO, the shmem-specific pointer is NULL, causing a kernel NULL dereference. The fix adds an explicit type check before proceeding with the transfer, rejecting VRAM BOs early. Patches are available in the stable kernel tree across five commits targeting different stable branches (Feedly, EUVD).

Successful exploitation of this vulnerability allows a local unprivileged user with access to the virtio GPU device to trigger a kernel NULL pointer dereference, resulting in a kernel panic and system crash (denial of service). The primary impact is on availability; there is no evidence of confidentiality or integrity compromise. Systems running virtualized Linux guests using the virtio GPU driver (e.g., QEMU/KVM guests) are the primary affected assets (Feedly).

Apply the upstream Linux kernel patches that add the shmem BO type check in the drm/virtio driver. Fixed versions include Linux kernel stable releases 5.10.150, 5.15.75, 5.19.17, 6.0.3, and 6.1. Administrators running virtualized Linux guests with the virtio GPU driver should update to a patched kernel version as soon as possible. If patching is not immediately feasible, restricting unprivileged user access to the virtio GPU device can reduce exposure (Feedly, EUVD).