CVE-2022-50722
published 2025-12-24CVE-2022-50722: In the Linux kernel, the following vulnerability has been resolved: media: ipu3-imgu: Fix NULL pointer dereference in active selection access What the IMGU…
PriorityP421
EPSS
0.21%
11.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
media: ipu3-imgu: Fix NULL pointer dereference in active selection access
What the IMGU driver did was that it first acquired the pointers to active
and try V4L2 subdev state, and only then figured out which one to use.
The problem with that approach and a later patch (see Fixes: tag) is that
as sd_state argument to v4l2_subdev_get_try_crop() et al is NULL, there is
now an attempt to dereference that.
Fix this.
Also rewrap lines a little.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.6-1 (bookworm) | linux 6.0.6-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 0d346d2a6f54f06f36b224fd27cd6eafe8c83be9 < 5265cc1202a31f7097691c3483a0d60d624424a5 | 5265cc1202a31f7097691c3483a0d60d624424a5 |
| linux | linux | >= 0d346d2a6f54f06f36b224fd27cd6eafe8c83be9 < 740717b756c17190dc2d2ad4c6de1e63f214e0c9 | 740717b756c17190dc2d2ad4c6de1e63f214e0c9 |
| linux | linux | >= 0d346d2a6f54f06f36b224fd27cd6eafe8c83be9 < b9eb3ab6f30bf32f7326909f17949ccb11bab514 | b9eb3ab6f30bf32f7326909f17949ccb11bab514 |
| linux | linux_kernel | >= 0 < 6.0.6-1 | 6.0.6-1 |
| linux | linux_kernel | >= 0 < 6.0.6-1 | 6.0.6-1 |
| linux | linux_kernel | >= 0 < 6.0.6-1 | 6.0.6-1 |
| linux | linux_kernel | >= 5.14.0 < 5.15.76 | 5.15.76 |
| linux | linux_kernel | >= 5.16.0 < 6.0.6 | 6.0.6 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: media: ipu3-imgu: Fix NULL pointer dereference in active selection access
vendor_redhat·2025-12-24
CVE-2022-50722 kernel: media: ipu3-imgu: Fix NULL pointer dereference in active selection access
kernel: media: ipu3-imgu: Fix NULL pointer dereference in active selection access
In the Linux kernel, the following vulnerability has been resolved:
media: ipu3-imgu: Fix NULL pointer dereference in active selection access
What the IMGU driver did was that it first acquired the pointers to active
and try V4L2 subdev state, and only then figured out which one to use.
The problem with that approach and a later patch (see Fixes: tag) is that
as sd_state argument to v4l2_subdev_get_try_crop() et al is NULL, there is
now an attempt to dereference that.
Fix this.
Also rewrap lines a little.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (R
Debian
CVE-2022-50722: linux - In the Linux kernel, the following vulnerability has been resolved: media: ipu3...
vendor_debian·2022
CVE-2022-50722 CVE-2022-50722: linux - In the Linux kernel, the following vulnerability has been resolved: media: ipu3...
In the Linux kernel, the following vulnerability has been resolved: media: ipu3-imgu: Fix NULL pointer dereference in active selection access What the IMGU driver did was that it first acquired the pointers to active and try V4L2 subdev state, and only then figured out which one to use. The problem with that approach and a later patch (see Fixes: tag) is that as sd_state argument to v4l2_subdev_get_try_crop() et al is NULL, there is now an attempt to dereference that. Fix this. Also rewrap lines a little.
Scope: local
bookworm: resolved (fixed in 6.0.6-1)
bullseye: resolved
forky: resolved (fixed in 6.0.6-1)
sid: resolved (fixed in 6.0.6-1)
trixie: resolved (fixed in 6.0.6-1)
VulDB
Linux Kernel up to 5.15.75/6.0.5 IMGU Driver v4l2_subdev_get_try_crop sd_state null pointer dereference (Nessus ID 280055 / WID-SEC-2025-2929)
vuldb·2026-04-21
CVE-2022-50722 [CRITICAL] Linux Kernel up to 5.15.75/6.0.5 IMGU Driver v4l2_subdev_get_try_crop sd_state null pointer dereference (Nessus ID 280055 / WID-SEC-2025-2929)
A vulnerability classified as critical has been found in Linux Kernel up to 5.15.75/6.0.5. This impacts the function v4l2_subdev_get_try_crop of the component IMGU Driver. The manipulation of the argument sd_state leads to null pointer dereference.
This vulnerability is listed as CVE-2022-50722. The attack must be carried out from within the local network. There is no available exploit.
It is recommended to upgrade the affected component.
OSV
media: ipu3-imgu: Fix NULL pointer dereference in active selection access
osv·2025-12-24
CVE-2022-50722 media: ipu3-imgu: Fix NULL pointer dereference in active selection access
media: ipu3-imgu: Fix NULL pointer dereference in active selection access
In the Linux kernel, the following vulnerability has been resolved:
media: ipu3-imgu: Fix NULL pointer dereference in active selection access
What the IMGU driver did was that it first acquired the pointers to active
and try V4L2 subdev state, and only then figured out which one to use.
The problem with that approach and a later patch (see Fixes: tag) is that
as sd_state argument to v4l2_subdev_get_try_crop() et al is NULL, there is
now an attempt to dereference that.
Fix this.
Also rewrap lines a little.
OSV
CVE-2022-50722: In the Linux kernel, the following vulnerability has been resolved: media: ipu3-imgu: Fix NULL pointer dereference in active selection access What the
osv·2025-12-24
CVE-2022-50722 CVE-2022-50722: In the Linux kernel, the following vulnerability has been resolved: media: ipu3-imgu: Fix NULL pointer dereference in active selection access What the
In the Linux kernel, the following vulnerability has been resolved: media: ipu3-imgu: Fix NULL pointer dereference in active selection access What the IMGU driver did was that it first acquired the pointers to active and try V4L2 subdev state, and only then figured out which one to use. The problem with that approach and a later patch (see Fixes: tag) is that as sd_state argument to v4l2_subdev_get_try_crop() et al is NULL, there is now an attempt to dereference that. Fix this. Also rewrap lines a little.
GHSA
GHSA-vpqj-28g2-5g9m: In the Linux kernel, the following vulnerability has been resolved:
media: ipu3-imgu: Fix NULL pointer dereference in active selection access
What t
ghsa_unreviewed·2025-12-24
CVE-2022-50722 GHSA-vpqj-28g2-5g9m: In the Linux kernel, the following vulnerability has been resolved:
media: ipu3-imgu: Fix NULL pointer dereference in active selection access
What t
In the Linux kernel, the following vulnerability has been resolved:
media: ipu3-imgu: Fix NULL pointer dereference in active selection access
What the IMGU driver did was that it first acquired the pointers to active
and try V4L2 subdev state, and only then figured out which one to use.
The problem with that approach and a later patch (see Fixes: tag) is that
as sd_state argument to v4l2_subdev_get_try_crop() et al is NULL, there is
now an attempt to dereference that.
Fix this.
Also rewrap lines a little.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2022-50722 kernel: media: ipu3-imgu: Fix NULL pointer dereference in active selection access
bugzilla·2025-12-24
CVE-2022-50722 CVE-2022-50722 kernel: media: ipu3-imgu: Fix NULL pointer dereference in active selection access
CVE-2022-50722 kernel: media: ipu3-imgu: Fix NULL pointer dereference in active selection access
In the Linux kernel, the following vulnerability has been resolved:
media: ipu3-imgu: Fix NULL pointer dereference in active selection access
What the IMGU driver did was that it first acquired the pointers to active
and try V4L2 subdev state, and only then figured out which one to use.
The problem with that approach and a later patch (see Fixes: tag) is that
as sd_state argument to v4l2_subdev_get_try_crop() et al is NULL, there is
now an attempt to dereference that.
Fix this.
Also rewrap lines a little.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025122417-CVE-2022-50722-06c7@gregkh/T
Wiz
CVE-2022-50722 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2022-50722 CVE-2022-50722 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2022-50722 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
media: ipu3-imgu: Fix NULL pointer dereference in active selection access
What the IMGU driver did was that it first acquired the pointers to active
and try V4L2 subdev state, and only then figured out which one to use.
The problem with that approach and a later patch (see Fixes: tag) is that
as sd_state argument to v4l2_subdev_get_try_crop() et al is NULL, there is
now an attempt to dereference that.
Fix this.
Also rewrap lines a little.
Source : NVD
Published December 24, 2025
CNA Score N/A
Affected Technologies
Linux Kernel
Linux Debian
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exp
2025-12-24
Published