CVE-2022-50884: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50884 is a NULL pointer dereference vulnerability in the Linux kernel's DRM (Direct Rendering Manager) subsystem, specifically in the drm_copy_field() function. When a DRM driver fails to initialize required fields in struct drm_driver, the drm_copy_field() function — invoked during DRM_IOCTL_VERSION handling — may attempt to copy a NULL pointer to user space, triggering a kernel oops. The vulnerability was published on December 30, 2025, and affects multiple stable Linux kernel versions. It carries an estimated CVSS severity of Medium with an EPSS score of 0.047% (Feedly, CVE.org).

The root cause is a missing NULL pointer check in drm_copy_field() (CWE-476: NULL Pointer Dereference). When a DRM driver has a bug and leaves certain struct drm_driver string fields (such as name, desc, or date) uninitialized (NULL), the function passes the NULL pointer to __pi_strlen as part of a user-space copy operation triggered by the DRM_IOCTL_VERSION ioctl. This results in a kernel-level memory access fault at virtual address 0x0000000000000000, as evidenced by the kernel oops trace showing pc: __pi_strlen+0x14/0x150 called from lr: drm_copy_field+0x30/0x1a4. The fix adds a NULL guard in drm_copy_field() so that unset fields are safely handled rather than dereferenced. Patches are referenced in the Linux stable kernel repository at commits 2d6708ea, 6cf5e935, 8052612b, c28a8082, and ca163e38 (Feedly, kernel.org).

Successful triggering of this vulnerability causes a kernel oops (system crash), resulting in a denial of service for the affected host. Because the fault occurs in kernel context during ioctl processing, any local user with access to a DRM device node (typically /dev/dri/cardX) could potentially trigger the crash if a buggy driver is loaded. There is no evidence of confidentiality or integrity impact; the primary consequence is availability loss through an unhandled kernel panic (Feedly).

The fix has been applied to multiple Linux stable kernel branches via patches at commits 2d6708ea5c20, 6cf5e9356b2d, 8052612b9d08, c28a8082b25c, and ca163e389f0a in the Linux stable kernel repository. Users should update to a patched kernel version as provided by their distribution. Vendor-specific advisories have been issued by Amazon Linux (ALAS2KERNEL-5.15-2025-090) and SUSE (SUSE-2026-0350-1), and Tenable Nessus plugins 280787, 298924, and 302405 are available for detection. As a workaround, avoiding the use of DRM drivers known to leave required fields uninitialized can reduce exposure, but upgrading the kernel is the recommended remediation (Amazon Linux Advisory, SUSE Advisory, Tenable).