{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2022-50647 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2022-50647 is a denial of service vulnerability in Linux, published on 9 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-50647 and fix it if it is affected.\n\nWhat it is: CVE-2022-50647 is a denial of service vulnerability in Linux, published on 9 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2022-50647 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-50647/ (Markdown: https://insights.sbomify.com/CVE-2022-50647/index.md)","id":"CVE-2022-50647","markdown":"https://insights.sbomify.com/CVE-2022-50647/index.md","name":"CVE-2022-50647","record":{"aliases":["DEBIAN-CVE-2022-50647","GHSA-gvvr-vj5m-jq76","UBUNTU-CVE-2022-50647"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A local attacker can trigger a kernel crash by accessing specific parallel port I/O operations on RISC-V systems.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nRISC-V: Make port I/O string accessors actually work\n\nFix port I/O string accessors such as `insb', `outsb', etc. which use\nthe physical PCI port I/O address rather than the corresponding memory\nmapping to get at the requested location, which in turn breaks at least\naccesses made by our parport driver to a PCIe parallel port such as:\n\nPCI parallel port detected: 1415:c118, I/O at 0x1000(0x1008), IRQ 20\nparport0: PC-style at 0x1000 (0x1008), irq 20, using FIFO [PCSPP,TRISTATE,COMPAT,EPP,ECP]\n\ncausing a memory access fault:\n\nUnable to handle kernel access to user memory without uaccess routines at virtual address 0000000000001008\nOops [#1]\nModules linked in:\nCPU: 1 PID: 350 Comm: cat Not tainted 6.0.0-rc2-00283-g10d4879f9ef0-dirty #23\nHardware name: SiFive HiFive Unmatched A00 (DT)\nepc : parport_pc_fifo_write_block_pio+0x266/0x416\n ra : parport_pc_fifo_write_block_pio+0xb4/0x416\nepc : ffffffff80542c3e ra : ffffffff80542a8c sp : ffffffd88899fc60\n gp : ffffffff80fa2700 tp : ffffffd882b1e900 t0 : ffffffd883d0b000\n t1 : ffffffffff000002 t2 : 4646393043330a38 s0 : ffffffd88899fcf0\n s1 : 0000000000001000 a0 : 0000000000000010 a1 : 0000000000000000\n a2 : ffffffd883d0a010 a3 : 0000000000000023 a4 : 00000000ffff8fbb\n a5 : ffffffd883d0a001 a6 : 0000000100000000 a7 : ffffffc800000000\n s2 : ffffffffff000002 s3 : ffffffff80d28880 s4 : ffffffff80fa1f50\n s5 : 0000000000001008 s6 : 0000000000000008 s7 : ffffffd883d0a000\n s8 : 0004000000000000 s9 : ffffffff80dc1d80 s10: ffffffd8807e4000\n s11: 0000000000000000 t3 : 00000000000000ff t4 : 393044410a303930\n t5 : 0000000000001000 t6 : 0000000000040000\nstatus: 0000000200000120 badaddr: 0000000000001008 cause: 000000000000000f\n[\u003cffffffff80543212\u003e] parport_pc_compat_write_block_pio+0xfe/0x200\n[\u003cffffffff8053bbc0\u003e] parport_write+0x46/0xf8\n[\u003cffffffff8050530e\u003e] lp_write+0x158/0x2d2\n[\u003cffffffff80185716\u003e] vfs_write+0x8e/0x2c2\n[\u003cffffffff80185a74\u003e] ksys_write+0x52/0xc2\n[\u003cffffffff80185af2\u003e] sys_write+0xe/0x16\n[\u003cffffffff80003770\u003e] ret_from_syscall+0x0/0x2\n---[ end trace 0000000000000000 ]---\n\nFor simplicity address the problem by adding PCI_IOBASE to the physical\naddress requested in the respective wrapper macros only, observing that\nthe raw accessors such as `__insb', `__outsb', etc. are not supposed to\nbe used other than by said macros.  Remove the cast to `long' that is no\nlonger needed on `addr' now that it is used as an offset from PCI_IOBASE\nand add parentheses around `addr' needed for predictable evaluation in\nmacro expansion.  No need to make said adjustments in separate changes\ngiven that current code is gravely broken and does not ever work.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"RISC-V: Make port I/O string accessors actually work","id":"CVE-2022-50647","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2022"},"n_packages":0,"n_references":6,"next":{"headline":"ftrace: Fix recursive locking direct_mutex in ftrace_modify_direct_caller","id":"CVE-2022-50648"},"packages":[],"prev":{"headline":"scsi: hpsa: Fix possible memory leak in hpsa_init_one()","id":"CVE-2022-50646"},"products":["Linux"],"published":"2025-12-09","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"A local attacker can trigger a kernel crash by accessing specific parallel port I/O operations on RISC-V systems.","url":"https://insights.sbomify.com/CVE-2022-50647/"}