CVE-2022-50558

Vulnerability

Overview

The Linux kernel's regmap-irq subsystem suffers from a NULL pointer dereference vulnerability. The root cause is that the function regmap_add_irq_chip_fwnode was not updated to use the num_config_regs property introduced in commit faa87ce9196d, and instead continued relying on the deprecated num_type_reg field. When a driver (e.g., ASoC wcd9335) removed the old num_type_reg from its struct regmap_irq_chip, the allocation for the internal d->type_buf buffer was skipped, leading to a kernel crash [1].

Exploitation and

Trigger

The vulnerability is triggered when the kernel attempts to configure an IRQ type via regmap_irq_set_type, which indexes into the unallocated d->type_buf pointer. This occurs during normal IRQ setup, such as when a driver calls request_threaded_irq after the regmap IRQ chip registration. No special privileges or unusual attack surface are required — it can be hit simply by loading the affected driver and using the associated hardware.

Impact

An attacker with the ability to trigger IRQ setup on a system using a vulnerable driver (like the wcd9335 audio codec) can cause a kernel NULL pointer dereference, leading to a denial of service (system crash or hang). The crash trace shows an Oops in regmap_irq_set_type with a NULL pointer access at address 0.

Mitigation

The fix has been applied in the Linux kernel stable tree, commit 57bb34330c0f [1]. The patch changes regmap_add_irq_chip_fwnode to use num_config_regs and falls back to num_type_reg for backward compatibility. Users should update their kernel to a version containing this commit (e.g., 5.10.x or later stable releases) to avoid the vulnerability.