CVE-2022-50722 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
media: ipu3-imgu: Fix NULL pointer dereference in active selection access
What the IMGU driver did was that it first acquired the pointers to active and try V4L2 subdev state, and only then figured out which one to use.
The problem with that approach and a later patch (see Fixes: tag) is that as sd_state argument to v4l2_subdev_get_try_crop() et al is NULL, there is now an attempt to dereference that.
Fix this.
Also rewrap lines a little.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/21/2026
The vulnerability identified as CVE-2022-50722 represents a critical null pointer dereference flaw within the Linux kernel's media subsystem, specifically affecting the ipu3-imgu driver component. This driver manages image processing units for Intel processors and is part of the broader V4L2 (Video4Linux2) framework that handles multimedia device operations. The issue stems from improper handling of subdevice state pointers during the active selection access process, creating a scenario where the system attempts to dereference a null pointer reference that should have been validated before use.
The technical implementation flaw occurs in the driver's logic flow where the code first acquires pointers to active and try V4L2 subdev states without proper validation of whether these pointers contain valid references. This problematic approach leads to situations where the sd_state argument passed to functions like v4l2_subdev_get_try_crop() contains a NULL value, causing the kernel to attempt memory access on an invalid pointer location. This type of vulnerability falls under CWE-476, which specifically addresses NULL pointer dereference conditions that can lead to system crashes or potential privilege escalation scenarios. The vulnerability manifests when the kernel processes video capture operations through the ipu3-imgu driver, particularly during crop parameter handling in the V4L2 subdevice interface.
The operational impact of this vulnerability extends beyond simple system crashes, as it can potentially be exploited by malicious actors to cause denial of service conditions or, in more sophisticated scenarios, to gain unauthorized access to kernel memory spaces. When the kernel encounters the null pointer dereference, it typically results in a kernel oops or panic, leading to system instability and potential data loss. The vulnerability affects systems running Linux kernels that include the ipu3-imgu driver, particularly those utilizing Intel processors with integrated image processing units. According to ATT&CK framework categorization, this vulnerability maps to T1499.004 (Unauthorized Command Execution) and T1547.001 (Registry Run Keys/Startup Folder) as it can be leveraged to disrupt system operations and potentially establish persistent access through kernel-level exploitation.
The fix implemented for this vulnerability involves reworking the driver's pointer validation logic to ensure that all subdevice state pointers are properly checked before being passed to V4L2 functions. This remediation approach aligns with secure coding practices that mandate input validation and defensive programming techniques. The solution requires that the driver first validate whether the sd_state argument contains a valid reference before attempting to dereference it, thereby preventing the kernel from accessing invalid memory locations. Organizations should prioritize applying the kernel patches that address this specific vulnerability, as the fix directly resolves the null pointer dereference condition and restores proper memory management within the ipu3-imgu driver component. The remediation process involves updating to kernel versions that include the specific commit addressing this issue, which typically includes additional validation checks and proper error handling for subdevice state management operations.