{"id":"CVE-2022-50320","title":"ACPI: tables: FPDT: Don't call acpi_os_map_memory() on invalid phys address","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: tables: FPDT: Don't call acpi_os_map_memory() on invalid phys address\n\nOn a Packard Bell Dot SC (Intel Atom N2600 model) there is a FPDT table\nwhich contains inva…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= d1eb86e59be09c12447fcb959783cbc70a9bec01 < 30eca146c89d216dda95868ce00a2d35cf73d5a4","Linux >= d1eb86e59be09c12447fcb959783cbc70a9bec01 < 90bfc9ae875dfbed2e6089516520204cd431dba3","Linux >= d1eb86e59be09c12447fcb959783cbc70a9bec01 < 16046a716c8e1f447909bec9b478d58e6e25e513","Linux >= d1eb86e59be09c12447fcb959783cbc70a9bec01 < 211391bf04b3c74e250c566eeff9cf808156c693","Linux 5.12"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:09:45.486970Z"},"published":"2025-09-15","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:10:34.827Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2022-50320","references":[{"url":"https://git.kernel.org/stable/c/30eca146c89d216dda95868ce00a2d35cf73d5a4"},{"url":"https://git.kernel.org/stable/c/90bfc9ae875dfbed2e6089516520204cd431dba3"},{"url":"https://git.kernel.org/stable/c/16046a716c8e1f447909bec9b478d58e6e25e513"},{"url":"https://git.kernel.org/stable/c/211391bf04b3c74e250c566eeff9cf808156c693"}],"tags":["cve.org"],"epss":0.00167,"epssPercentile":0.06039,"ingestedAt":"2026-11-05T22:38:31.726Z","slug":"CVE-2022-50320","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nACPI: tables: FPDT: Don't call acpi_os_map_memory() on invalid phys address\n\nOn a Packard Bell Dot SC (Intel Atom N2600 model) there is a FPDT table\nwhich contains invalid physical addresses, with high bits set which fall\noutside the range of the CPU-s supported physical address range.\n\nCalling acpi_os_map_memory() on such an invalid phys address leads to\nthe below WARN_ON in ioremap triggering resulting in an oops/stacktrace.\n\nAdd code to verify the physical address before calling acpi_os_map_memory()\nto fix / avoid the oops.\n\n[    1.226900] ioremap: invalid physical address 3001000000000000\n[    1.226949] ------------[ cut here ]------------\n[    1.226962] WARNING: CPU: 1 PID: 1 at arch/x86/mm/ioremap.c:200 __ioremap_caller.cold+0x43/0x5f\n[    1.226996] Modules linked in:\n[    1.227016] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.0.0-rc3+ #490\n[    1.227029] Hardware name: Packard Bell dot s/SJE01_CT, BIOS V1.10 07/23/2013\n[    1.227038] RIP: 0010:__ioremap_caller.cold+0x43/0x5f\n[    1.227054] Code: 96 00 00 e9 f8 af 24 ff 89 c6 48 c7 c7 d8 0c 84 99 e8 6a 96 00 00 e9 76 af 24 ff 48 89 fe 48 c7 c7 a8 0c 84 99 e8 56 96 00 00 <0f> 0b e9 60 af 24 ff 48 8b 34 24 48 c7 c7 40 0d 84 99 e8 3f 96 00\n[    1.227067] RSP: 0000:ffffb18c40033d60 EFLAGS: 00010286\n[    1.227084] RAX: 0000000000000032 RBX: 3001000000000000 RCX: 0000000000000000\n[    1.227095] RDX: 0000000000000001 RSI: 00000000ffffdfff RDI: 00000000ffffffff\n[    1.227105] RBP: 3001000000000000 R08: 0000000000000000 R09: ffffb18c40033c18\n[    1.227115] R10: 0000000000000003 R11: ffffffff99d62fe8 R12: 0000000000000008\n[    1.227124] R13: 0003001000000000 R14: 0000000000001000 R15: 3001000000000000\n[    1.227135] FS:  0000000000000000(0000) GS:ffff913a3c080000(0000) knlGS:0000000000000000\n[    1.227146] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    1.227156] CR2: 0000000000000000 CR3: 0000000018c26000 CR4: 00000000000006e0\n[    1.227167] Call Trace:\n[    1.227176]  <TASK>\n[    1.227185]  ? acpi_os_map_iomem+0x1c9/0x1e0\n[    1.227215]  ? kmem_cache_alloc_trace+0x187/0x370\n[    1.227254]  acpi_os_map_iomem+0x1c9/0x1e0\n[    1.227288]  acpi_init_fpdt+0xa8/0x253\n[    1.227308]  ? acpi_debugfs_init+0x1f/0x1f\n[    1.227339]  do_one_initcall+0x5a/0x300\n[    1.227406]  ? rcu_read_lock_sched_held+0x3f/0x80\n[    1.227442]  kernel_init_freeable+0x28b/0x2cc\n[    1.227512]  ? rest_init+0x170/0x170\n[    1.227538]  kernel_init+0x16/0x140\n[    1.227552]  ret_from_fork+0x1f/0x30\n[    1.227639]  </TASK>\n[    1.227647] irq event stamp: 186819\n[    1.227656] hardirqs last  enabled at (186825): [<ffffffff98184a6e>] __up_console_sem+0x5e/0x70\n[    1.227672] hardirqs last disabled at (186830): [<ffffffff98184a53>] __up_console_sem+0x43/0x70\n[    1.227686] softirqs last  enabled at (186576): [<ffffffff980fbc9d>] __irq_exit_rcu+0xed/0x160\n[    1.227701] softirqs last disabled at (186569): [<ffffffff980fbc9d>] __irq_exit_rcu+0xed/0x160\n[    1.227715] ---[ end trace 0000000000000000 ]---\n\n## Affected\n\n- `Linux >= d1eb86e59be09c12447fcb959783cbc70a9bec01 < 30eca146c89d216dda95868ce00a2d35cf73d5a4`\n- `Linux >= d1eb86e59be09c12447fcb959783cbc70a9bec01 < 90bfc9ae875dfbed2e6089516520204cd431dba3`\n- `Linux >= d1eb86e59be09c12447fcb959783cbc70a9bec01 < 16046a716c8e1f447909bec9b478d58e6e25e513`\n- `Linux >= d1eb86e59be09c12447fcb959783cbc70a9bec01 < 211391bf04b3c74e250c566eeff9cf808156c693`\n- `Linux 5.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}