CVE-2022-50875: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50875 is a null pointer dereference vulnerability in the Linux kernel's Device Tree (OF) overlay subsystem, specifically in the find_dup_cset_node_entry() and find_dup_cset_prop() functions. The flaw was published on December 30, 2025, and affects Linux kernel versions from 5.0 up to (but not including) the patched stable releases. When kmalloc() fails to allocate memory via kasprintf(), the resulting NULL pointer for fn_1 or fn_2 is subsequently passed to strcmp(), triggering a null pointer dereference. The CVSS base score is listed as 0.0 (no severity rating assigned at time of publication) (Feedly, ENISA EUVD).

The root cause is a missing NULL check after kasprintf() calls within the OF overlay duplicate changeset detection logic (CWE-476: NULL Pointer Dereference). When the kernel's memory allocator fails under memory pressure, kasprintf() returns NULL, and the subsequent strcmp() call on the NULL pointer causes a kernel panic or crash. The vulnerability is reachable in kernel code paths that process Device Tree overlays, which are typically triggered by privileged operations (e.g., loading overlays via configfs or firmware). Fixes were applied across multiple stable branches, with patch commits available on kernel.org for the 5.4, 5.10, 5.15, 6.0, 6.1, and 6.2 series (Feedly, ENISA EUVD).

Successful triggering of this vulnerability causes a kernel null pointer dereference, which typically results in a kernel panic (system crash) and denial of service. Because the affected code path is in kernel space, there is no direct path to arbitrary code execution or privilege escalation based on currently available information. The primary impact is availability — an attacker or process with sufficient privilege to load Device Tree overlays could crash the affected system (Feedly).

The Linux kernel project has released fixes across multiple stable branches. Patched versions include Linux 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2 (mainline). Users should update to the appropriate patched stable kernel version for their distribution. No configuration-based workaround is known; upgrading the kernel is the recommended remediation (ENISA EUVD, Tenable).