# CVE-2022-50647: linux: In the Linux kernel, the following vulnerability has been resolved:  RISC-V: Make port I/O string accessors actually...

CVE-2022-50647 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-50647, released December 9, 2025. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2022-50647
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0021
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Dec 9, 2025

## Description

In the Linux kernel, the following vulnerability has been resolved:  RISC-V: Make port I/O string accessors actually work  Fix port I/O string accessors such as `insb', `outsb', etc. which use the physical PCI port I/O address rather than the corresponding memory mapping to get at the requested location, which in turn breaks at least accesses made by our parport driver to a PCIe parallel port such as:  PCI parallel port detected: 1415:c118, I/O at 0x1000(0x1008), IRQ 20 parport0: PC-style at 0x1000 (0x1008), irq 20, using FIFO [PCSPP,TRISTATE,COMPAT,EPP,ECP]  causing a memory access fault:  Unable to handle kernel access to user memory without uaccess routines at virtual address 0000000000001008 Oops [#1] Modules linked in: CPU: 1 PID: 350 Comm: cat Not tainted 6.0.0-rc2-00283-g10d4879f9ef0-dirty #23 Hardware name: SiFive HiFive Unmatched A00 (DT) epc : parport_pc_fifo_write_block_pio+0x266/0x416  ra : parport_pc_fifo_write_block_pio+0xb4/0x416 epc : ffffffff80542c3e ra : ffffffff80542a8c sp : ffffffd88899fc60  gp : ffffffff80fa2700 tp : ffffffd882b1e900 t0 : ffffffd883d0b000  t1 : ffffffffff000002 t2 : 4646393043330a38 s0 : ffffffd88899fcf0  s1 : 0000000000001000 a0 : 0000000000000010 a1 : 0000000000000000  a2 : ffffffd883d0a010 a3 : 0000000000000023 a4 : 00000000ffff8fbb  a5 : ffffffd883d0a001 a6 : 0000000100000000 a7 : ffffffc800000000  s2 : ffffffffff000002 s3 : ffffffff80d28880 s4 : ffffffff80fa1f50  s5 : 0000000000001008 s6 : 0000000000000008 s7 : ffffffd883d0a000  s8 : 0004000000000000 s9 : ffffffff80dc1d80 s10: ffffffd8807e4000  s11: 0000000000000000 t3 : 00000000000000ff t4 : 393044410a303930  t5 : 0000000000001000 t6 : 0000000000040000 status: 0000000200000120 badaddr: 0000000000001008 cause: 000000000000000f [<ffffffff80543212>] parport_pc_compat_write_block_pio+0xfe/0x200 [<ffffffff8053bbc0>] parport_write+0x46/0xf8 [<ffffffff8050530e>] lp_write+0x158/0x2d2 [<ffffffff80185716>] vfs_write+0x8e/0x2c2 [<ffffffff80185a74>] ksys_write+0x52/0xc2 [<ffffffff80185af2>] sys_write+0xe/0x16 [<ffffffff80003770>] ret_from_syscall+0x0/0x2 ---[ end trace 0000000000000000 ]---  For simplicity address the problem by adding PCI_IOBASE to the physical address requested in the respective wrapper macros only, observing that the raw accessors such as `__insb', `__outsb', etc. are not supposed to be used other than by said macros.  Remove the cast to `long' that is no longer needed on `addr' now that it is used as an offset from PCI_IOBASE and add parentheses around `addr' needed for predictable evaluation in macro expansion.  No need to make said adjustments in separate changes given that current code is gravely broken and does not ever work.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.0.3-1 | [DEBIAN-CVE-2022-50647](https://patchblox.com/security/data/fix/linux/debian-cve-2022-50647.md) | Dec 9, 2025 |
| Linux | linux Debian 13.5 (trixie) | 6.0.3-1 | [DEBIAN-CVE-2022-50647](https://patchblox.com/security/data/fix/linux/debian-cve-2022-50647.md) | Dec 9, 2025 |
| Linux | linux Debian 14 | 6.0.3-1 | [DEBIAN-CVE-2022-50647](https://patchblox.com/security/data/fix/linux/debian-cve-2022-50647.md) | Dec 9, 2025 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.