CVE-2022-50873: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50873 is a kernel crash vulnerability in the Linux kernel's vDPA (virtio Data Path Acceleration) subsystem, specifically in the vp_vdpa driver. The bug exists in the vp_vdpa_remove() function, where kfree() is called with the address of a pointer (i.e., &vp_vdpa_mgtdev->mgtdev.id_table) rather than the pointer value itself, resulting in freeing an incorrect memory address. This can trigger a kernel panic ("Unable to handle kernel paging request") on affected systems. The vulnerability affects Linux kernel versions from commit ffbda8e9df10 up to the fixes applied in stable releases 6.0.19, 6.1.5, and 6.2. It was published on December 30, 2025, with an EPSS score of 0.00017 (very low) and no CVSS base score assigned (Feedly, EUVD).

The root cause is an incorrect pointer argument passed to kfree() in the vp_vdpa_remove() function of the Linux kernel's vdpa/vp_vdpa.c driver (CWE-763: Release of Invalid Pointer or Reference). Instead of freeing the memory pointed to by vp_vdpa_mgtdev->mgtdev.id_table, the code incorrectly passes the address of the id_table pointer field itself (&vp_vdpa_mgtdev->mgtdev.id_table), which is an interior struct member address rather than a heap-allocated pointer. This causes the kernel memory allocator to attempt to free an invalid address, leading to a kernel oops/panic. The crash manifests as a paging fault on ARM64 systems, as shown in the call trace involving rb_next, ext4_readdir, and iterate_dir. Exploitation requires local access to trigger the vDPA device removal path (Feedly, EUVD).

Successful triggering of this vulnerability causes a kernel panic, resulting in a complete system crash and denial of service. The affected component is the vp_vdpa virtio device management driver, so systems using vDPA hardware acceleration (e.g., virtualization hosts with virtio-net offload) are at risk during device removal operations. There is no evidence of confidentiality or integrity impact; the primary consequence is availability loss due to the kernel oops (Feedly).

There is no known public exploit code, exploit kit integration, or evidence of in-the-wild exploitation for CVE-2022-50873. The EPSS score is 0.00017, indicating an extremely low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Triggering the bug requires local access to a system with a vDPA-capable device and the ability to initiate device removal, significantly limiting the attack surface (Feedly).

The fix has been backported to stable Linux kernel releases: 6.0.19, 6.1.5, and 6.2. The correcting commits are 8fe12680b2c7 (for one stable branch), 6ccc891f36d0 (for another), and ed843d6ed731 (for a third), all available via the kernel stable tree. Administrators should update to a patched kernel version. As a workaround, systems that do not use vDPA hardware acceleration can unload or avoid loading the vp_vdpa kernel module to eliminate exposure (EUVD, Kernel Stable).