CVE-2022-50888 remoteproc: qcom: q6v5: Fix potential null-ptr-deref in q6v5_wcss_init_mmio()
A null pointer dereference in the Qualcomm remoteproc driver can cause a kernel crash, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50888?
CVE-2022-50888 is a vulnerability in Linux, published on 30 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
remoteproc: qcom: q6v5: Fix potential null-ptr-deref in q6v5_wcss_init_mmio()
q6v5_wcss_init_mmio() will call platform_get_resource_byname() that may fail and return NULL. devm_ioremap() will use res->start as input, which may causes null-ptr-deref. Check the ret value of platform_get_resource_byname() to avoid the null-ptr-deref.
Which versions are affected by CVE-2022-50888?
How do I fix CVE-2022-50888?
Apply the vendor's patch.
Is CVE-2022-50888 being exploited?
There is no known exploitation of CVE-2022-50888 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2022-50888, GHSA-rv29-96pv-jm8g, UBUNTU-CVE-2022-50888.