CVE-2022-50657 riscv: mm: add missing memcpy in kasan_init
Missing memory copy in RISC-V KASAN initialization causes page faults and system crashes when accessing shadow regions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50657?
CVE-2022-50657 is a vulnerability in Linux, published on 9 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
riscv: mm: add missing memcpy in kasan_init
Hi Atish,
It seems that the panic is due to the missing memcpy during kasan_init. Could you please check whether this patch is helpful?
When doing kasan_populate, the new allocated base_pud/base_p4d should contain kasan_early_shadow_{pud, p4d}'s content. Add the missing memcpy to avoid page fault when read/write kasan shadow region.
Tested on: - qemu with sv57 and CONFIG_KASAN on. - qemu with sv48 and CONFIG_KASAN on.
Which versions are affected by CVE-2022-50657?
How do I fix CVE-2022-50657?
Apply the vendor's patch.
Is CVE-2022-50657 being exploited?
There is no known exploitation of CVE-2022-50657 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2022-50657, GHSA-jcqw-583m-jhjv, UBUNTU-CVE-2022-50657.