CVE-2022-50230 in Linux
Summary
by MITRE • 06/18/2025
In the Linux kernel, the following vulnerability has been resolved:
arm64: set UXN on swapper page tables
[ This issue was fixed upstream by accident in c3cee924bd85 ("arm64:
head: cover entire kernel image in initial ID map") as part of a large refactoring of the arm64 boot flow. This simple fix is therefore preferred for -stable backporting ]
On a system that implements FEAT_EPAN, read/write access to the idmap is denied because UXN is not set on the swapper PTEs. As a result, idmap_kpti_install_ng_mappings panics the kernel when accessing __idmap_kpti_flag. Fix it by setting UXN on these PTEs.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 01/29/2026
The vulnerability described in CVE-2022-50230 represents a critical memory protection flaw within the Linux kernel's arm64 architecture implementation. This issue specifically affects systems that implement the FEAT_EPAN (Extended Page Addressing) feature, which enables enhanced memory management capabilities. The vulnerability stems from an improper configuration of user execute disable (UXN) permissions on swapper page table entries, creating a potential pathway for privilege escalation and system instability. The problem manifests during kernel boot processes when the initial identity mapping is established, particularly in systems utilizing kernel page table isolation (KPTI) mechanisms.
The technical root cause lies in the incorrect handling of page table entries within the swapper context on arm64 platforms. When FEAT_EPAN is enabled, the system should deny read/write access to the identity mapping through proper UXN enforcement on swapper PTEs. However, due to a gap in the boot process implementation, UXN was not being properly set on these critical page table entries. This omission allows malicious code or compromised processes to potentially access kernel memory regions that should remain protected, particularly when the kernel attempts to install non-global mappings during the KPTI initialization process. The specific panic occurs when accessing the __idmap_kpti_flag variable, which triggers a kernel crash due to the improper memory access permissions.
The operational impact of this vulnerability extends beyond simple system instability to encompass potential security breaches and denial of service conditions. Systems implementing FEAT_EPAN that have not received the fix are susceptible to kernel panics during boot operations, resulting in complete system crashes and potential data loss. More critically, the absence of proper UXN enforcement creates a potential attack vector where malicious actors could exploit the misconfigured memory permissions to escalate privileges or access sensitive kernel data. This vulnerability affects the fundamental memory protection mechanisms that are essential for maintaining system integrity and security boundaries, particularly in environments where KPTI is enabled for enhanced security against side-channel attacks.
The fix for this vulnerability involves implementing proper UXN setting on swapper page table entries during the kernel boot process, specifically addressing the issue identified in the arm64 boot flow refactoring. The upstream solution was implemented through commit c3cee924bd85, which correctly covers the entire kernel image within the initial identity mapping. This fix ensures that swapper PTEs properly enforce UXN permissions, preventing unauthorized read/write access to kernel memory regions. Organizations should prioritize applying this patch to systems implementing FEAT_EPAN, particularly those using KPTI for enhanced security. The vulnerability aligns with CWE-119 (Improper Access Control) and CWE-284 (Improper Access Control) categories, and represents a potential entry point for techniques described in ATT&CK matrix under privilege escalation and defense evasion tactics. System administrators should verify that their kernel versions include this fix and consider implementing additional monitoring for kernel panics or memory access violations that might indicate exploitation attempts.