{
  "cveId": "CVE-2022-50332",
  "url": "https://patchblox.com/security/cve/CVE-2022-50332",
  "summary": "CVE-2022-50332 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-50332, released September 15, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  video/aperture: Call sysfb_disable() before remo...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  video/aperture: Call sysfb_disable() before removing PCI devices  Call sysfb_disable() from aperture_remove_conflicting_pci_devices() before removing PCI devices. Without, simpledrm can still bind to simple-framebuffer devices after the hardware driver has taken over the hardware. Both drivers interfere with each other and results are undefined.  Reported modesetting errors [1] are shown below.  ---- snap ---- rcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { 13-.... } 7 jiffies s: 165 root: 0x2000/. rcu: blocking rcu_node structures (internal RCU debug): Task dump for CPU 13: task:X               state:R  running task     stack:    0 pid: 4242 ppid:  4228 flags:0x00000008 Call Trace:  \u003CTASK\u003E  ? commit_tail\u002B0xd7/0x130  ? drm_atomic_helper_commit\u002B0x126/0x150  ? drm_atomic_commit\u002B0xa4/0xe0  ? drm_plane_get_damage_clips.cold\u002B0x1c/0x1c  ? drm_atomic_helper_dirtyfb\u002B0x19e/0x280  ? drm_mode_dirtyfb_ioctl\u002B0x10f/0x1e0  ? drm_mode_getfb2_ioctl\u002B0x2d0/0x2d0  ? drm_ioctl_kernel\u002B0xc4/0x150  ? drm_ioctl\u002B0x246/0x3f0  ? drm_mode_getfb2_ioctl\u002B0x2d0/0x2d0  ? __x64_sys_ioctl\u002B0x91/0xd0  ? do_syscall_64\u002B0x60/0xd0  ? entry_SYSCALL_64_after_hwframe\u002B0x4b/0xb5  \u003C/TASK\u003E ... rcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { 13-.... } 30 jiffies s: 169 root: 0x2000/. rcu: blocking rcu_node structures (internal RCU debug): Task dump for CPU 13: task:X               state:R  running task     stack:    0 pid: 4242 ppid:  4228 flags:0x0000400e Call Trace:  \u003CTASK\u003E  ? memcpy_toio\u002B0x76/0xc0  ? memcpy_toio\u002B0x1b/0xc0  ? drm_fb_memcpy_toio\u002B0x76/0xb0  ? drm_fb_blit_toio\u002B0x75/0x2b0  ? simpledrm_simple_display_pipe_update\u002B0x132/0x150  ? drm_atomic_helper_commit_planes\u002B0xb6/0x230  ? drm_atomic_helper_commit_tail\u002B0x44/0x80  ? commit_tail\u002B0xd7/0x130  ? drm_atomic_helper_commit\u002B0x126/0x150  ? drm_atomic_commit\u002B0xa4/0xe0  ? drm_plane_get_damage_clips.cold\u002B0x1c/0x1c  ? drm_atomic_helper_dirtyfb\u002B0x19e/0x280  ? drm_mode_dirtyfb_ioctl\u002B0x10f/0x1e0  ? drm_mode_getfb2_ioctl\u002B0x2d0/0x2d0  ? drm_ioctl_kernel\u002B0xc4/0x150  ? drm_ioctl\u002B0x246/0x3f0  ? drm_mode_getfb2_ioctl\u002B0x2d0/0x2d0  ? __x64_sys_ioctl\u002B0x91/0xd0  ? do_syscall_64\u002B0x60/0xd0  ? entry_SYSCALL_64_after_hwframe\u002B0x4b/0xb5  \u003C/TASK\u003E  The problem was added by commit 5e0137612430 (\u0022video/aperture: Disable and unregister sysfb devices via aperture helpers\u0022) to v6.0.3 and does not exist in the mainline branch.  The mainline commit 5e0137612430 (\u0022video/aperture: Disable and unregister sysfb devices via aperture helpers\u0022) has been backported from v6.0-rc1 to stable v6.0.3 from a larger patch series [2] that reworks fbdev framebuffer ownership. The backport misses a change to aperture_remove_conflicting_pci_devices(). Mainline itself is fine, because the function does not exist there as a result of the patch series.  Instead of backporting the whole series, fix the additional function.",
  "published": "2025-09-15T15:15:45Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00138,
  "epssPercentile": 0.0324,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.0.6-1",
      "fix": "DEBIAN-CVE-2022-50332",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50332",
      "released": "2025-09-15T15:15:45Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.0.6-1",
      "fix": "DEBIAN-CVE-2022-50332",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50332",
      "released": "2025-09-15T15:15:45Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.0.6-1",
      "fix": "DEBIAN-CVE-2022-50332",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50332",
      "released": "2025-09-15T15:15:45Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}