{"id":"DEBIAN-CVE-2022-50094","details":"In the Linux kernel, the following vulnerability has been resolved:  spmi: trace: fix stack-out-of-bound access in SPMI tracing functions  trace_spmi_write_begin() and trace_spmi_read_end() both call memcpy() with a length of \"len + 1\".  This leads to one extra byte being read beyond the end of the specified buffer.  Fix this out-of-bound memory access by using a length of \"len\" instead.  Here is a KASAN log showing the issue:  BUG: KASAN: stack-out-of-bounds in trace_event_raw_event_spmi_read_end+0x1d0/0x234 Read of size 2 at addr ffffffc0265b7540 by task thermal@2.0-ser/1314 ... Call trace:  dump_backtrace+0x0/0x3e8  show_stack+0x2c/0x3c  dump_stack_lvl+0xdc/0x11c  print_address_description+0x74/0x384  kasan_report+0x188/0x268  kasan_check_range+0x270/0x2b0  memcpy+0x90/0xe8  trace_event_raw_event_spmi_read_end+0x1d0/0x234  spmi_read_cmd+0x294/0x3ac  spmi_ext_register_readl+0x84/0x9c  regmap_spmi_ext_read+0x144/0x1b0 [regmap_spmi]  _regmap_raw_read+0x40c/0x754  regmap_raw_read+0x3a0/0x514  regmap_bulk_read+0x418/0x494  adc5_gen3_poll_wait_hs+0xe8/0x1e0 [qcom_spmi_adc5_gen3]  ...  __arm64_sys_read+0x4c/0x60  invoke_syscall+0x80/0x218  el0_svc_common+0xec/0x1c8  ...  addr ffffffc0265b7540 is located in stack of task thermal@2.0-ser/1314 at offset 32 in frame:  adc5_gen3_poll_wait_hs+0x0/0x1e0 [qcom_spmi_adc5_gen3]  this frame has 1 object:  [32, 33) 'status'  Memory state around the buggy address:  ffffffc0265b7400: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1  ffffffc0265b7480: 04 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 \u003effffffc0265b7500: 00 00 00 00 f1 f1 f1 f1 01 f3 f3 f3 00 00 00 00                                            ^  ffffffc0265b7580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ffffffc0265b7600: f1 f1 f1 f1 01 f2 07 f2 f2 f2 01 f3 00 00 00 00 ==================================================================","modified":"2026-09-01T16:05:34.382357877Z","published":"2025-06-18T11:15:38.620Z","upstream":["CVE-2022-50094"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2022-50094"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50094.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50094.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50094.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}]}