CVE-2022-50185 drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()
A buffer overflow in the Radeon DRM driver allows attackers to potentially execute arbitrary code or escalate privileges within the Linux kernel.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50185?
CVE-2022-50185 is a high-severity memory corruption vulnerability in Linux kernel, published on 18 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()
The last case label can write two buffers 'mc_reg_address[j]' and 'mc_data[j]' with 'j' offset equal to SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE since there are no checks for this value in both case labels after the last 'j++'.
Instead of changing '>' to '>=' there, add the bounds check at the start of the second 'case' (the first one already has it).
Also, remove redundant last checks for 'j' index bigger than array size. The expression is always false. Moreover, before or after the patch 'table->last' can be equal to SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE and it seems it can be a valid value.
Detected using the static analysis tool - Svace.
Weakness: CWE-787
Which versions are affected by CVE-2022-50185?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-50185?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-50185 being exploited?
There is no known exploitation of CVE-2022-50185 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-50185, GHSA-qf4p-cxx8-7gvw, UBUNTU-CVE-2022-50185.