{
  "cveId": "CVE-2022-50094",
  "url": "https://patchblox.com/security/cve/CVE-2022-50094",
  "summary": "CVE-2022-50094 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-50094, released June 18, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  spmi: trace: fix stack-out-of-bound access in SP...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  spmi: trace: fix stack-out-of-bound access in SPMI tracing functions  trace_spmi_write_begin() and trace_spmi_read_end() both call memcpy() with a length of \u0022len \u002B 1\u0022.  This leads to one extra byte being read beyond the end of the specified buffer.  Fix this out-of-bound memory access by using a length of \u0022len\u0022 instead.  Here is a KASAN log showing the issue:  BUG: KASAN: stack-out-of-bounds in trace_event_raw_event_spmi_read_end\u002B0x1d0/0x234 Read of size 2 at addr ffffffc0265b7540 by task thermal@2.0-ser/1314 ... Call trace:  dump_backtrace\u002B0x0/0x3e8  show_stack\u002B0x2c/0x3c  dump_stack_lvl\u002B0xdc/0x11c  print_address_description\u002B0x74/0x384  kasan_report\u002B0x188/0x268  kasan_check_range\u002B0x270/0x2b0  memcpy\u002B0x90/0xe8  trace_event_raw_event_spmi_read_end\u002B0x1d0/0x234  spmi_read_cmd\u002B0x294/0x3ac  spmi_ext_register_readl\u002B0x84/0x9c  regmap_spmi_ext_read\u002B0x144/0x1b0 [regmap_spmi]  _regmap_raw_read\u002B0x40c/0x754  regmap_raw_read\u002B0x3a0/0x514  regmap_bulk_read\u002B0x418/0x494  adc5_gen3_poll_wait_hs\u002B0xe8/0x1e0 [qcom_spmi_adc5_gen3]  ...  __arm64_sys_read\u002B0x4c/0x60  invoke_syscall\u002B0x80/0x218  el0_svc_common\u002B0xec/0x1c8  ...  addr ffffffc0265b7540 is located in stack of task thermal@2.0-ser/1314 at offset 32 in frame:  adc5_gen3_poll_wait_hs\u002B0x0/0x1e0 [qcom_spmi_adc5_gen3]  this frame has 1 object:  [32, 33) \u0027status\u0027  Memory state around the buggy address:  ffffffc0265b7400: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1  ffffffc0265b7480: 04 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 \u003Effffffc0265b7500: 00 00 00 00 f1 f1 f1 f1 01 f3 f3 f3 00 00 00 00                                            ^  ffffffc0265b7580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ffffffc0265b7600: f1 f1 f1 f1 01 f2 07 f2 f2 f2 01 f3 00 00 00 00 ==================================================================",
  "published": "2025-06-18T11:15:38Z",
  "severity": "high",
  "cvss": 7.1,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
  "epss": 0.00264,
  "epssPercentile": 0.18449,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.0.2-1",
      "fix": "DEBIAN-CVE-2022-50094",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50094",
      "released": "2025-06-18T11:15:38Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.0.2-1",
      "fix": "DEBIAN-CVE-2022-50094",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50094",
      "released": "2025-06-18T11:15:38Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.0.2-1",
      "fix": "DEBIAN-CVE-2022-50094",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50094",
      "released": "2025-06-18T11:15:38Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}