GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50394 (GCVE-0-2022-50394)

Vulnerability from cvelistv5 – Published: 2025-09-18 13:33 – Updated: 2026-08-05 08:58
VLAI
Title
i2c: ismt: Fix an out-of-bounds bug in ismt_access()
Summary
In the Linux kernel, the following vulnerability has been resolved: i2c: ismt: Fix an out-of-bounds bug in ismt_access() When the driver does not check the data from the user, the variable 'data->block[0]' may be very large to cause an out-of-bounds bug. The following log can reveal it: [ 33.995542] i2c i2c-1: ioctl, cmd=0x720, arg=0x7ffcb3dc3a20 [ 33.995978] ismt_smbus 0000:00:05.0: I2C_SMBUS_BLOCK_DATA: WRITE [ 33.996475] ================================================================== [ 33.996995] BUG: KASAN: out-of-bounds in ismt_access.cold+0x374/0x214b [ 33.997473] Read of size 18446744073709551615 at addr ffff88810efcfdb1 by task ismt_poc/485 [ 33.999450] Call Trace: [ 34.001849] memcpy+0x20/0x60 [ 34.002077] ismt_access.cold+0x374/0x214b [ 34.003382] __i2c_smbus_xfer+0x44f/0xfb0 [ 34.004007] i2c_smbus_xfer+0x10a/0x390 [ 34.004291] i2cdev_ioctl_smbus+0x2c8/0x710 [ 34.005196] i2cdev_ioctl+0x5ec/0x74c Fix this bug by checking the size of 'data->block[0]' first.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 18:51 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9 , < 4a7bb1d93addb2f67e36fed00a53cb7f270d7b7a (git)
Affected: 13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9 , < 03b7ef7a6c5ca1ff553470166b4919db88b810f6 (git)
Affected: 13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9 , < bfe41d966c860a8ad4c735639d616da270c92735 (git)
Affected: 13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9 , < cdcbae2c5003747ddfd14e29db9c1d5d7e7c44dd (git)
Affected: 13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9 , < 9ac541a0898e8ec187a3fa7024b9701cffae6bf2 (git)
Affected: 13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9 , < 96c12fd0ec74641295e1c3c34dea3dce1b6c3422 (git)
Affected: 13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9 , < a642469d464b2780a25a49b51ae56623c65eac34 (git)
Affected: 13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9 , < 233348a04becf133283f0076e20b317302de21d9 (git)
Affected: 13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9 , < 39244cc754829bf707dccd12e2ce37510f5b1f8d (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.9
Unaffected: 0 , < 3.9 (semver)
Unaffected: 4.9.337 , ≤ 4.9.* (semver)
Unaffected: 4.14.303 , ≤ 4.14.* (semver)
Unaffected: 4.19.270 , ≤ 4.19.* (semver)
Unaffected: 5.4.229 , ≤ 5.4.* (semver)
Unaffected: 5.10.163 , ≤ 5.10.* (semver)
Unaffected: 5.15.86 , ≤ 5.15.* (semver)
Unaffected: 6.0.16 , ≤ 6.0.* (semver)
Unaffected: 6.1.2 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-50394",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:51:21.854586Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T18:53:05.857Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/i2c/busses/i2c-ismt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4a7bb1d93addb2f67e36fed00a53cb7f270d7b7a",
              "status": "affected",
              "version": "13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9",
              "versionType": "git"
            },
            {
              "lessThan": "03b7ef7a6c5ca1ff553470166b4919db88b810f6",
              "status": "affected",
              "version": "13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9",
              "versionType": "git"
            },
            {
              "lessThan": "bfe41d966c860a8ad4c735639d616da270c92735",
              "status": "affected",
              "version": "13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9",
              "versionType": "git"
            },
            {
              "lessThan": "cdcbae2c5003747ddfd14e29db9c1d5d7e7c44dd",
              "status": "affected",
              "version": "13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9",
              "versionType": "git"
            },
            {
              "lessThan": "9ac541a0898e8ec187a3fa7024b9701cffae6bf2",
              "status": "affected",
              "version": "13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9",
              "versionType": "git"
            },
            {
              "lessThan": "96c12fd0ec74641295e1c3c34dea3dce1b6c3422",
              "status": "affected",
              "version": "13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9",
              "versionType": "git"
            },
            {
              "lessThan": "a642469d464b2780a25a49b51ae56623c65eac34",
              "status": "affected",
              "version": "13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9",
              "versionType": "git"
            },
            {
              "lessThan": "233348a04becf133283f0076e20b317302de21d9",
              "status": "affected",
              "version": "13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9",
              "versionType": "git"
            },
            {
              "lessThan": "39244cc754829bf707dccd12e2ce37510f5b1f8d",
              "status": "affected",
              "version": "13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/i2c/busses/i2c-ismt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.9"
            },
            {
              "lessThan": "3.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.337",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.303",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.229",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.337",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.303",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.270",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.229",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.163",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.86",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.16",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.2",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: ismt: Fix an out-of-bounds bug in ismt_access()\n\nWhen the driver does not check the data from the user, the variable\n\u0027data-\u003eblock[0]\u0027 may be very large to cause an out-of-bounds bug.\n\nThe following log can reveal it:\n\n[   33.995542] i2c i2c-1: ioctl, cmd=0x720, arg=0x7ffcb3dc3a20\n[   33.995978] ismt_smbus 0000:00:05.0: I2C_SMBUS_BLOCK_DATA:  WRITE\n[   33.996475] ==================================================================\n[   33.996995] BUG: KASAN: out-of-bounds in ismt_access.cold+0x374/0x214b\n[   33.997473] Read of size 18446744073709551615 at addr ffff88810efcfdb1 by task ismt_poc/485\n[   33.999450] Call Trace:\n[   34.001849]  memcpy+0x20/0x60\n[   34.002077]  ismt_access.cold+0x374/0x214b\n[   34.003382]  __i2c_smbus_xfer+0x44f/0xfb0\n[   34.004007]  i2c_smbus_xfer+0x10a/0x390\n[   34.004291]  i2cdev_ioctl_smbus+0x2c8/0x710\n[   34.005196]  i2cdev_ioctl+0x5ec/0x74c\n\nFix this bug by checking the size of \u0027data-\u003eblock[0]\u0027 first."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reachable only via local I2C_SMBUS ioctl on /dev/i2c-* (i2cdev_ioctl \u2192 i2cdev_ioctl_smbus \u2192 i2c_smbus_xfer \u2192 ismt_access); not network- or physically-triggered.\nAC:L - Attacker fully controls block[0] in the ioctl payload and can reliably trigger the OOB memcpy (including the u8 wrap to SIZE_MAX when block[0]==255); no race or external conditions required.\nPR:L - No capability check in i2cdev_open; access is only gated by /dev/i2c-* permissions, which commonly allow non-root users (e.g. i2c group). Matches sibling i2c block-length scores such as CVE-2026-64191.\nUI:N - Exploitation requires only the attacker\u0027s own open/ioctl sequence; no victim action is needed.\nS:U - Impact is confined to the host kernel privilege boundary (memory corruption / DoS); no VM escape or cross-authority boundary crossing.\nC:H - memcpy performs an unbounded/out-of-bounds read from union i2c_smbus_data past the 34-byte block buffer, disclosing adjacent kernel memory; oversized DMA mapping can further expose kernel data.\nI:H - The same memcpy writes past priv-\u003ebuffer into adjacent ismt_priv fields (e.g. log_dma/log), giving a heap structure corruption / write primitive; out-of-bounds write is High per guidance.\nA:H - The OOB access causes a kernel oops/KASAN crash (as in the reported PoC), enabling reliable denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:58:32.577Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4a7bb1d93addb2f67e36fed00a53cb7f270d7b7a"
        },
        {
          "url": "https://git.kernel.org/stable/c/03b7ef7a6c5ca1ff553470166b4919db88b810f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfe41d966c860a8ad4c735639d616da270c92735"
        },
        {
          "url": "https://git.kernel.org/stable/c/cdcbae2c5003747ddfd14e29db9c1d5d7e7c44dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ac541a0898e8ec187a3fa7024b9701cffae6bf2"
        },
        {
          "url": "https://git.kernel.org/stable/c/96c12fd0ec74641295e1c3c34dea3dce1b6c3422"
        },
        {
          "url": "https://git.kernel.org/stable/c/a642469d464b2780a25a49b51ae56623c65eac34"
        },
        {
          "url": "https://git.kernel.org/stable/c/233348a04becf133283f0076e20b317302de21d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/39244cc754829bf707dccd12e2ce37510f5b1f8d"
        }
      ],
      "title": "i2c: ismt: Fix an out-of-bounds bug in ismt_access()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50394",
    "datePublished": "2025-09-18T13:33:12.992Z",
    "dateReserved": "2025-09-17T14:53:06.998Z",
    "dateUpdated": "2026-08-05T08:58:32.577Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50394",
      "date": "2026-09-17",
      "epss": "0.00167",
      "percentile": "0.06412"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50394\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-18T14:15:38.490\",\"lastModified\":\"2026-08-04T10:18:14.340\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ni2c: ismt: Fix an out-of-bounds bug in ismt_access()\\n\\nWhen the driver does not check the data from the user, the variable\\n\u0027data-\u003eblock[0]\u0027 may be very large to cause an out-of-bounds bug.\\n\\nThe following log can reveal it:\\n\\n[   33.995542] i2c i2c-1: ioctl, cmd=0x720, arg=0x7ffcb3dc3a20\\n[   33.995978] ismt_smbus 0000:00:05.0: I2C_SMBUS_BLOCK_DATA:  WRITE\\n[   33.996475] ==================================================================\\n[   33.996995] BUG: KASAN: out-of-bounds in ismt_access.cold+0x374/0x214b\\n[   33.997473] Read of size 18446744073709551615 at addr ffff88810efcfdb1 by task ismt_poc/485\\n[   33.999450] Call Trace:\\n[   34.001849]  memcpy+0x20/0x60\\n[   34.002077]  ismt_access.cold+0x374/0x214b\\n[   34.003382]  __i2c_smbus_xfer+0x44f/0xfb0\\n[   34.004007]  i2c_smbus_xfer+0x10a/0x390\\n[   34.004291]  i2cdev_ioctl_smbus+0x2c8/0x710\\n[   34.005196]  i2cdev_ioctl+0x5ec/0x74c\\n\\nFix this bug by checking the size of \u0027data-\u003eblock[0]\u0027 first.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/i2c/busses/i2c-ismt.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9\",\"lessThan\":\"4a7bb1d93addb2f67e36fed00a53cb7f270d7b7a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9\",\"lessThan\":\"03b7ef7a6c5ca1ff553470166b4919db88b810f6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9\",\"lessThan\":\"bfe41d966c860a8ad4c735639d616da270c92735\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9\",\"lessThan\":\"cdcbae2c5003747ddfd14e29db9c1d5d7e7c44dd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9\",\"lessThan\":\"9ac541a0898e8ec187a3fa7024b9701cffae6bf2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9\",\"lessThan\":\"96c12fd0ec74641295e1c3c34dea3dce1b6c3422\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9\",\"lessThan\":\"a642469d464b2780a25a49b51ae56623c65eac34\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9\",\"lessThan\":\"233348a04becf133283f0076e20b317302de21d9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9\",\"lessThan\":\"39244cc754829bf707dccd12e2ce37510f5b1f8d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/i2c/busses/i2c-ismt.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.9.337\",\"lessThanOrEqual\":\"4.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.303\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.270\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.229\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.163\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.86\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0.16\",\"lessThanOrEqual\":\"6.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.2\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-01-14T18:51:21.854586Z\",\"id\":\"CVE-2022-50394\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.9\",\"versionEndExcluding\":\"4.9.337\",\"matchCriteriaId\":\"0E0273F2-224A-448F-92F6-D08F1E18B7CD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10\",\"versionEndExcluding\":\"4.14.303\",\"matchCriteriaId\":\"1E7450AD-4739-46F0-B81B-C02E7B35A97B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.270\",\"matchCriteriaId\":\"AE8904A3-99BE-4E49-9682-1F90A6373F4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.229\",\"matchCriteriaId\":\"A0C0D95E-414A-445E-941B-3EF6A4D3A093\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.163\",\"matchCriteriaId\":\"D05D31FC-BD74-4F9E-B1D8-9CED62BE6F65\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.86\",\"matchCriteriaId\":\"47237296-55D1-4ED4-8075-D00FC85A61EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.0.16\",\"matchCriteriaId\":\"C720A569-3D93-4D77-95F6-E2B3A3267D9F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1\",\"versionEndExcluding\":\"6.1.2\",\"matchCriteriaId\":\"77239F4B-6BB2-4B9E-A654-36A52396116C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/03b7ef7a6c5ca1ff553470166b4919db88b810f6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/233348a04becf133283f0076e20b317302de21d9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/39244cc754829bf707dccd12e2ce37510f5b1f8d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4a7bb1d93addb2f67e36fed00a53cb7f270d7b7a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/96c12fd0ec74641295e1c3c34dea3dce1b6c3422\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9ac541a0898e8ec187a3fa7024b9701cffae6bf2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a642469d464b2780a25a49b51ae56623c65eac34\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bfe41d966c860a8ad4c735639d616da270c92735\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cdcbae2c5003747ddfd14e29db9c1d5d7e7c44dd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T11:47:20+00:00",
      "cve": "CVE-2022-50394",
      "id": "CVE-2022-50394",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: i2c: ismt: Fix an out-of-bounds bug in ismt_access()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50394.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.1, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-50394\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-14T18:51:21.854586Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125 Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-14T18:51:17.904Z\"}}], \"cna\": {\"title\": \"i2c: ismt: Fix an out-of-bounds bug in ismt_access()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9\", \"lessThan\": \"4a7bb1d93addb2f67e36fed00a53cb7f270d7b7a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9\", \"lessThan\": \"03b7ef7a6c5ca1ff553470166b4919db88b810f6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9\", \"lessThan\": \"bfe41d966c860a8ad4c735639d616da270c92735\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9\", \"lessThan\": \"cdcbae2c5003747ddfd14e29db9c1d5d7e7c44dd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9\", \"lessThan\": \"9ac541a0898e8ec187a3fa7024b9701cffae6bf2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9\", \"lessThan\": \"96c12fd0ec74641295e1c3c34dea3dce1b6c3422\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9\", \"lessThan\": \"a642469d464b2780a25a49b51ae56623c65eac34\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9\", \"lessThan\": \"233348a04becf133283f0076e20b317302de21d9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9\", \"lessThan\": \"39244cc754829bf707dccd12e2ce37510f5b1f8d\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/i2c/busses/i2c-ismt.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.9.337\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.9.*\"}, {\"status\": \"unaffected\", \"version\": \"4.14.303\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.270\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.229\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.163\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.86\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.0.16\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.0.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.2\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/i2c/busses/i2c-ismt.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/4a7bb1d93addb2f67e36fed00a53cb7f270d7b7a\"}, {\"url\": \"https://git.kernel.org/stable/c/03b7ef7a6c5ca1ff553470166b4919db88b810f6\"}, {\"url\": \"https://git.kernel.org/stable/c/bfe41d966c860a8ad4c735639d616da270c92735\"}, {\"url\": \"https://git.kernel.org/stable/c/cdcbae2c5003747ddfd14e29db9c1d5d7e7c44dd\"}, {\"url\": \"https://git.kernel.org/stable/c/9ac541a0898e8ec187a3fa7024b9701cffae6bf2\"}, {\"url\": \"https://git.kernel.org/stable/c/96c12fd0ec74641295e1c3c34dea3dce1b6c3422\"}, {\"url\": \"https://git.kernel.org/stable/c/a642469d464b2780a25a49b51ae56623c65eac34\"}, {\"url\": \"https://git.kernel.org/stable/c/233348a04becf133283f0076e20b317302de21d9\"}, {\"url\": \"https://git.kernel.org/stable/c/39244cc754829bf707dccd12e2ce37510f5b1f8d\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ni2c: ismt: Fix an out-of-bounds bug in ismt_access()\\n\\nWhen the driver does not check the data from the user, the variable\\n\u0027data-\u003eblock[0]\u0027 may be very large to cause an out-of-bounds bug.\\n\\nThe following log can reveal it:\\n\\n[   33.995542] i2c i2c-1: ioctl, cmd=0x720, arg=0x7ffcb3dc3a20\\n[   33.995978] ismt_smbus 0000:00:05.0: I2C_SMBUS_BLOCK_DATA:  WRITE\\n[   33.996475] ==================================================================\\n[   33.996995] BUG: KASAN: out-of-bounds in ismt_access.cold+0x374/0x214b\\n[   33.997473] Read of size 18446744073709551615 at addr ffff88810efcfdb1 by task ismt_poc/485\\n[   33.999450] Call Trace:\\n[   34.001849]  memcpy+0x20/0x60\\n[   34.002077]  ismt_access.cold+0x374/0x214b\\n[   34.003382]  __i2c_smbus_xfer+0x44f/0xfb0\\n[   34.004007]  i2c_smbus_xfer+0x10a/0x390\\n[   34.004291]  i2cdev_ioctl_smbus+0x2c8/0x710\\n[   34.005196]  i2cdev_ioctl+0x5ec/0x74c\\n\\nFix this bug by checking the size of \u0027data-\u003eblock[0]\u0027 first.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.9.337\", \"versionStartIncluding\": \"3.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.14.303\", \"versionStartIncluding\": \"3.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.270\", \"versionStartIncluding\": \"3.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.229\", \"versionStartIncluding\": \"3.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.163\", \"versionStartIncluding\": \"3.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.86\", \"versionStartIncluding\": \"3.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.0.16\", \"versionStartIncluding\": \"3.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.2\", \"versionStartIncluding\": \"3.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.2\", \"versionStartIncluding\": \"3.9\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T19:18:41.200Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-50394\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T19:18:41.200Z\", \"dateReserved\": \"2025-09-17T14:53:06.998Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-09-18T13:33:12.992Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.