CVE-2022-50649 power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()
An out-of-bounds read in the ADP5061 power supply driver allows attackers to read kernel memory or cause a system crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50649?
CVE-2022-50649 is a memory corruption vulnerability in Linux, published on 9 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()
ADP5061_CHG_STATUS_1_CHG_STATUS is masked with 0x07, which means a length of 8, but adp5061_chg_type array size is 4, may end up reading 4 elements beyond the end of the adp5061_chg_type[] array.
Which versions are affected by CVE-2022-50649?
How do I fix CVE-2022-50649?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-50649 being exploited?
There is no known exploitation of CVE-2022-50649 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2022-50649, GHSA-2qfw-gff9-vfpr, UBUNTU-CVE-2022-50649.