CVE-2022-50366 — powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue

Back Back to CVE browser

HIGH

powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue

Published Sep 17, 2025

7.1

HIGH

CVSS 3.1

EPSS 0.21%

Description

When value < time_unit, the parameter of ilog2() will be zero and the return value is -1. u64(-1) is too large for shift exponent and then will trigger shift-out-of-bounds:

shift exponent 18446744073709551615 is too large for 32-bit type 'int' Call Trace: rapl_compute_time_window_core rapl_write_data_raw set_time_window store_constraint_time_window_us

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
affected
- Version
  3.13
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <3.13
- Version
  4.14.296
  Status
  unaffected
  Constraints
  <=4.14.*
- Version
  4.19.262
  Status
  unaffected
  Constraints
  <=4.19.*
- Version
  4.9.331
  Status
  unaffected
  Constraints
  <=4.9.*
- Version
  5.10.150
  Status
  unaffected
  Constraints
  <=5.10.*
- Version
  5.15.75
  Status
  unaffected
  Constraints
  <=5.15.*
- Version
  5.19.17
  Status
  unaffected
  Constraints
  <=5.19.*
- Version
  5.4.220
  Status
  unaffected
  Constraints
  <=5.4.*
- Version
  6.0.3
  Status
  unaffected
  Constraints
  <=6.0.*
- Version
  6.1
  Status
  unaffected
  Constraints
  <=*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected
	affected
	affected
	affected
	affected
	affected
	affected
	affected

Linux

affected

Version	Status	Constraints
3.13	affected	-
0	unaffected	<3.13
4.14.296	unaffected	<=4.14.*
4.19.262	unaffected	<=4.19.*
4.9.331	unaffected	<=4.9.*
5.10.150	unaffected	<=5.10.*
5.15.75	unaffected	<=5.15.*
5.19.17	unaffected	<=5.19.*
5.4.220	unaffected	<=5.4.*
6.0.3	unaffected	<=6.0.*
6.1	unaffected	<=*

Red Hat Enterprise Linux 10

kernel

Not affected
Red Hat Enterprise Linux 6

kernel

Not affected
Red Hat Enterprise Linux 7

kernel

Not affected
Red Hat Enterprise Linux 7

kernel-rt

Not affected
Red Hat Enterprise Linux 8

kernel

Fix deferred
Red Hat Enterprise Linux 8

kernel-rt

Fix deferred
Red Hat Enterprise Linux 9

kernel

Fix deferred
Red Hat Enterprise Linux 9

kernel-rt

Fix deferred

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	kernel	Not affected	n/a
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 8	kernel	Fix deferred	n/a
Red Hat Enterprise Linux 8	kernel-rt	Fix deferred	n/a
Red Hat Enterprise Linux 9	kernel	Fix deferred	n/a
Red Hat Enterprise Linux 9	kernel-rt	Fix deferred	n/a

Remediation

Red Hat statement

This patch fixes a shift-out-of-bounds bug in the Intel RAPL driver when value < time_unit, which previously caused ilog2(0) to return -1. While not exploitable remotely, a local user with write access to RAPL sysfs controls could trigger a kernel warning or crash.

Metrics

0.21% 0.00213

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.00213

Score over time

2025–2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	0.21% (0.00213)	10.48th	v5 (v2026.06.15)
Jun 15, 2026	0.20% (0.00200)	9.87th	v5 (v2026.06.15)
Sep 18, 2025	0.03% (0.00033)	8.06th	v4 (v2025.03.14)

Weaknesses (2)

CWE-125

Out-of-bounds Read

CWE-190

Integer Overflow

References (14)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-50366		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2396107		Issue Tracking
https://git.kernel.org/stable/c/139bbbd01114433b80fe59f5e1330615aadf9752		Patch
https://git.kernel.org/stable/c/1d94af37565e4d3c26b0d63428e093a37d5b4c32		Patch
https://git.kernel.org/stable/c/2d93540014387d1c73b9ccc4d7895320df66d01b		Patch
https://git.kernel.org/stable/c/3eb0ba70376f6ee40fa843fc9cee49269370b0b3		Patch
https://git.kernel.org/stable/c/42f79dbb9514f726ff21df25f09cb0693b0b2445		Patch
https://git.kernel.org/stable/c/49a6ffdaed60f0eb52c198fafebc05994e16e305		Patch
https://git.kernel.org/stable/c/4ebba43384722adbd325baec3a12c572d94488eb		Patch
https://git.kernel.org/stable/c/6216b685b8f48ab7b721a6fd5acbf526b41c13e8		Patch
https://git.kernel.org/stable/c/708b9abe1b4a2f050a483db4b7edfc446b13df1f		Patch
https://lore.kernel.org/linux-cve-announce/2025091716-CVE-2022-50366-0f75@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2022-50366
https://www.cve.org/CVERecord?id=CVE-2022-50366