CVE-2022-50878: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50878 is a NULL pointer dereference vulnerability in the Linux kernel's GPU driver for the Lontium LT9611 HDMI bridge chip, specifically within the lt9611_connector_init() function. The flaw arises because bridge->encoder is dereferenced before a NULL check that confirms it may be NULL, leading to a potential kernel crash. It affects Linux kernel versions from the initial commit up to the fixes introduced in stable releases 5.10.150, 5.15.75, 5.19.17, 6.0.3, and 6.1. The CVE was published on December 30, 2025, with an EPSS score of approximately 0.018% (very low), and no CVSS base score has been formally assigned (Feedly, EUVD).

The root cause is a NULL pointer dereference (CWE-476) in the lt9611_connector_init() function of the gpu/drm/bridge/lontium-lt9611.c driver. Specifically, drm_connector_attach_encoder(&lt9611->connector, bridge->encoder) at line 810 dereferences bridge->encoder before the NULL guard check at line 812 (if (!bridge->encoder)), meaning the pointer is used unconditionally on all code paths leading to the check. This is a local, kernel-space bug that can be triggered when the LT9611 bridge driver initializes a connector without a valid encoder attached. Fixes were applied across multiple stable kernel branches via patches to the affected commit range (Feedly, EUVD).

Successful triggering of this vulnerability causes a kernel NULL pointer dereference, which typically results in a kernel panic (system crash), impacting availability. Because the flaw is in a GPU/DRM bridge driver, it is most likely triggered during device initialization on systems using the Lontium LT9611 HDMI bridge hardware. There is no evidence of confidentiality or integrity impact, and the vulnerability does not enable remote code execution or privilege escalation (Feedly).

The Linux kernel stable team has released patches addressing this vulnerability across multiple stable branches. Users should update to kernel versions 5.10.150 or later, 5.15.75 or later, 5.19.17 or later, 6.0.3 or later, or 6.1 or later. The fix corrects the ordering of the NULL check relative to the dereference of bridge->encoder in lt9611_connector_init(). Linux distribution vendors (e.g., Red Hat, Ubuntu, SUSE) should be consulted for distribution-specific kernel update packages (Feedly, EUVD).