CVE-2022-50866: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50866 is a null-pointer dereference vulnerability in the Linux kernel's ASoC (Audio System on Chip) PXA driver, specifically within the filter() function. The flaw arises because kasprintf() can return a NULL pointer when the underlying kmalloc() fails to allocate memory, and the return value is not checked before being passed to strcmp(). The vulnerability affects Linux kernel versions from commit 7a824e214e25a49442fe868dac0af8a904b24f58 up to multiple stable branch fix points. It was published on December 30, 2025, and has a CVSS base score of 0.0 as assessed by ENISA, reflecting its limited exploitability and local scope (Feedly, EUVD).

The root cause is a missing NULL-pointer check after a call to kasprintf() in the filter() function of the sound/soc/pxa driver subsystem (CWE-476: NULL Pointer Dereference). When the kernel's memory allocator fails under memory pressure, kasprintf() returns NULL, and the subsequent strcmp() call on that NULL pointer triggers a kernel NULL pointer dereference. The fix, applied across multiple stable branches, adds a NULL check on the return value of kasprintf() before proceeding with the string comparison (Feedly, Kernel Fix). Exploitation requires local access and the ability to trigger memory allocation failure in the affected code path.

Successful triggering of this vulnerability causes a kernel NULL pointer dereference, which typically results in a kernel panic (system crash), leading to a denial of service. Because the flaw is in a kernel audio driver, it primarily affects availability on systems using PXA-based audio hardware. There is no known path to privilege escalation or data exfiltration through this vulnerability (Feedly).

The Linux kernel maintainers have backported fixes to multiple stable branches. Patched versions include: 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. Users should update their Linux kernel to one of these patched versions or later. No configuration-based workaround is known; upgrading the kernel is the recommended remediation (Feedly, EUVD).