What’s Vulnerable › Vulnerabilities

CVE-2022-50888: remoteproc: qcom: q6v5: Fix potential null-ptr-deref in q6v5_wcss_init_mmio()

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-30 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom: q6v5: Fix potential null-ptr-deref in q6v5_wcss_init_mmio() q6v5_wcss_init_mmio() will call platform_get_resource_byname() that may fail and return NULL. devm_ioremap() will use res->start as input, which may causes null-ptr-deref. Check the ret value of platform_get_resource_byname() to avoid the null-ptr-deref.

Affected products

• Linux kernel: 5.13 — fixed in 6.2

How to fix

Upgrade to a fixed version: Linux kernel 6.2. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0903a87490a9ed456ac765a84dcc484c1ee42c32
• https://git.kernel.org/stable/c/098ebb9089c4eedea09333f912d105fa63377496
• https://git.kernel.org/stable/c/3afa88ae9911b65702a3aca9d92ea23fe496e56f
• https://git.kernel.org/stable/c/f360e2b275efbb745ba0af8b47d9ef44221be586

Get alerted when CVE-2022-50888 or the next vulnerability affects your stack