CVE-2022-50888: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50888 is a null pointer dereference vulnerability in the Linux kernel's remoteproc/qcom/q6v5 subsystem, specifically within the q6v5_wcss_init_mmio() function. The flaw arises when platform_get_resource_byname() fails and returns NULL, and the result is subsequently passed to devm_ioremap() without validation, causing a potential null pointer dereference. The vulnerability was published on December 30, 2025, and affects Linux kernel versions from 5.13 up to the patched releases (5.15.86, 6.0.16, 6.1.2, and 6.2). The CVSS base score is estimated as Medium by Feedly, with an EPSS score of 0.023% (Feedly, CIRCL).

The root cause is a missing NULL return value check after calling platform_get_resource_byname() in q6v5_wcss_init_mmio() within the Qualcomm Q6V5 remote processor driver (CWE-476: NULL Pointer Dereference). When the platform resource lookup fails, the returned NULL pointer is passed directly to devm_ioremap() as res->start, triggering a kernel null pointer dereference. The fix adds a return value check after platform_get_resource_byname() to abort initialization gracefully if the resource is not found. Patches were applied to multiple stable kernel branches (Kernel Stable, Kernel Stable).

Successful triggering of this vulnerability can cause a kernel null pointer dereference, leading to a kernel panic or system crash, impacting availability. The vulnerability is local in nature and primarily affects systems using Qualcomm Q6V5-based wireless co-processors (WCSS), such as certain embedded or mobile Linux platforms. There is no evidence of confidentiality or integrity impact; the primary risk is denial of service through kernel crash (Feedly, CIRCL).

The Linux kernel maintainers have released patches addressing this vulnerability in the following stable versions: 5.15.86, 6.0.16, 6.1.2, and 6.2. Users running affected kernel versions (5.13 and later, prior to the patched releases) on hardware utilizing Qualcomm Q6V5 WCSS remote processors should upgrade to a patched kernel version. No configuration-based workarounds are documented; upgrading the kernel is the recommended remediation (Kernel Stable, Kernel Stable).