CVE-2022-50847: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50847 is a NULL pointer dereference vulnerability in the Linux kernel's DRM bridge driver for the IT6505 DisplayPort transmitter chip (drm/bridge: it6505). The flaw occurs because the AUX channel is not initialized early enough during device probe, allowing a Hot Plug Detect (HPD) interrupt to trigger before the DRM subsystem registers the it6505 as a DRM bridge, causing a NULL pointer dereference. It affects Linux kernel versions from 5.18 up to (but not including) the patched stable releases 6.0.16, 6.1.2, and 6.2. The vulnerability was published on December 30, 2025, with a Feedly CVSS category estimate of Medium (Feedly, EUVD).

The root cause is a race condition during driver initialization classified as a NULL pointer dereference (CWE-476). In the it6505_i2c_probe function, the AUX channel structure is not initialized before the HPD interrupt handler is registered. If an HPD interrupt fires before the DRM subsystem completes bridge registration, the interrupt handler attempts to access the uninitialized AUX channel pointer, resulting in a kernel NULL pointer dereference. The fix moves AUX channel initialization earlier in it6505_i2c_probe to eliminate this race window (Feedly, EUVD).

Successful triggering of this vulnerability causes a kernel NULL pointer dereference, which typically results in a kernel panic (system crash), impacting availability of the affected system. The vulnerability is local in nature and requires physical or privileged access to a device with the IT6505 DisplayPort bridge chip. There is no known confidentiality or integrity impact, and lateral movement potential is minimal given the hardware-specific and local nature of the flaw (Feedly).

The Linux kernel stable team has released patches addressing this vulnerability in versions 6.0.16, 6.1.2, and 6.2. The fix is applied via commits 8ed8505803774fc3f36a432718036c21cc51e2ba, 172d4d64075075f955e6e416915e3f287eec514a, and e577d4b13064c337b83fe7edecb3f34e87144821 in the stable kernel tree. Users running affected kernel versions (5.18 through pre-patch 6.0.x/6.1.x) on hardware with the IT6505 DisplayPort bridge should upgrade to the patched stable releases. No configuration-based workaround is known; upgrading the kernel is the recommended remediation (EUVD, Feedly).