Linux Kernel up to 5.10.149/5.15.74/5.19.16/6.0.2 on 32-bit fpga dfl_feature_ioctl_set_irq integer overflow

Summaryinfo

A vulnerability was found in Linux Kernel up to 5.10.149/5.15.74/5.19.16/6.0.2 on 32-bit. It has been classified as critical. This vulnerability affects the function dfl_feature_ioctl_set_irq of the component fpga. Performing a manipulation results in integer overflow. This vulnerability is cataloged as CVE-2022-50623. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Linux Kernel up to 5.10.149/5.15.74/5.19.16/6.0.2 on 32-bit. It has been classified as critical. This affects the function dfl_feature_ioctl_set_irq of the component fpga. The manipulation with an unknown input leads to a integer overflow vulnerability. CWE is classifying the issue as CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: fpga: prevent integer overflow in dfl_feature_ioctl_set_irq() The "hdr.count * sizeof(s32)" multiplication can overflow on 32 bit systems leading to memory corruption. Use array_size() to fix that.

The advisory is shared at git.kernel.org. This vulnerability is uniquely identified as CVE-2022-50623 since 12/08/2025. Technical details are known, but no exploit is available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 02/22/2026).

Upgrading to version 5.10.150, 5.15.75, 5.19.17 or 6.0.3 eliminates this vulnerability. Applying the patch f59861946fa51bcc1f305809e4ebc1013b0ee61c/b94605f5cb99e90c8ca91523597a40e1bd59546b/1b5a931594f7ffd26d706614c37d4da0f2ffb6e7/940253af8b3865b76de8d1b46bcd4a700104852e/939bc5453b8cbdde9f1e5110ce8309aedb1b501a is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2025-2756). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Google Container-Optimized OS
• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• NetApp FAS
• NetApp AFF
• SUSE openSUSE
• RESF Rocky Linux
• Open Source Linux Kernel
• Microsoft Azure Linux

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.10.149
• 5.15.0
• 5.15.1
• 5.15.2
• 5.15.3
• 5.15.4
• 5.15.5
• 5.15.6
• 5.15.7
• 5.15.8
• 5.15.9
• 5.15.10
• 5.15.11
• 5.15.12
• 5.15.13
• 5.15.14
• 5.15.15
• 5.15.16
• 5.15.17
• 5.15.18
• 5.15.19
• 5.15.20
• 5.15.21
• 5.15.22
• 5.15.23
• 5.15.24
• 5.15.25
• 5.15.26
• 5.15.27
• 5.15.28
• 5.15.29
• 5.15.30
• 5.15.31
• 5.15.32
• 5.15.33
• 5.15.34
• 5.15.35
• 5.15.36
• 5.15.37
• 5.15.38
• 5.15.39
• 5.15.40
• 5.15.41
• 5.15.42
• 5.15.43
• 5.15.44
• 5.15.45
• 5.15.46
• 5.15.47
• 5.15.48
• 5.15.49
• 5.15.50
• 5.15.51
• 5.15.52
• 5.15.53
• 5.15.54
• 5.15.55
• 5.15.56
• 5.15.57
• 5.15.58
• 5.15.59
• 5.15.60
• 5.15.61
• 5.15.62
• 5.15.63
• 5.15.64
• 5.15.65
• 5.15.66
• 5.15.67
• 5.15.68
• 5.15.69
• 5.15.70
• 5.15.71
• 5.15.72
• 5.15.73
• 5.15.74
• 5.19.0
• 5.19.1
• 5.19.2
• 5.19.3
• 5.19.4
• 5.19.5
• 5.19.6
• 5.19.7
• 5.19.8
• 5.19.9
• 5.19.10
• 5.19.11
• 5.19.12
• 5.19.13
• 5.19.14
• 5.19.15
• 5.19.16
• 6.0.0
• 6.0.1
• 6.0.2

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion