CVE-2022-50542
media: si470x: Fix use-after-free in si470x_int_in_callback()
Description
In the Linux kernel, the following vulnerability has been resolved: media: si470x: Fix use-after-free in si470x_int_in_callback() syzbot reported use-after-free in si470x_int_in_callback() [1]. This indicates that urb->context, which contains struct si470x_device object, is freed when si470x_int_in_callback() is called. The cause of this issue is that si470x_int_in_callback() is called for freed urb. si470x_usb_driver_probe() calls si470x_start_usb(), which then calls usb_submit_urb() and si470x_start(). If si470x_start_usb() fails, si470x_usb_driver_probe() doesn't kill urb, but it just frees struct si470x_device object, as depicted below: si470x_usb_driver_probe() ... si470x_start_usb() ... usb_submit_urb() retval = si470x_start() return retval if (retval < 0) free struct si470x_device object, but don't kill urb This patch fixes this issue by killing urb when si470x_start_usb() fails and urb is submitted. If si470x_start_usb() fails and urb is not submitted, i.e. submitting usb fails, it just frees struct si470x_device object.
INFO
Published Date :
Oct. 7, 2025, 4:15 p.m.
Last Modified :
Feb. 4, 2026, 6:53 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Identify and apply the kernel patch.
- Rebuild and install the modified kernel.
- Reboot the system to load the new kernel.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2022-50542.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2022-50542 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2022-50542
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2022-50542 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2022-50542 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Feb. 04, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-416 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.10 up to (excluding) 4.14.303 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.15 up to (excluding) 4.19.270 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.4.229 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.0.16 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.1 up to (excluding) 6.1.2 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.163 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.86 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 3.6 up to (excluding) 4.9.337 Added Reference Type kernel.org: https://git.kernel.org/stable/c/0ca298d548461d29615f9a2b1309e8dcf4a352c6 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/146bd005ebb01ae190c22af050cb98623958c373 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/1c6447d0fc68650e51586dde79b5090d9d77f13a Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/52f54fe78cca24850a30865037250f63eb3d5bf7 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/63648a7bd1a7599bcc2040a6d1792363ae4c2e1b Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/6c8aee0c8fcc6dda94315f7908e8fa9bc75abe75 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/7d21e0b1b41b21d628bf2afce777727bd4479aa5 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/8c6151b8e8dd2d98ad2cd725d26d1e103d989891 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/92b0888398e4ba51d93b618a6506781f4e3879c9 Types: Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Oct. 07, 2025
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: media: si470x: Fix use-after-free in si470x_int_in_callback() syzbot reported use-after-free in si470x_int_in_callback() [1]. This indicates that urb->context, which contains struct si470x_device object, is freed when si470x_int_in_callback() is called. The cause of this issue is that si470x_int_in_callback() is called for freed urb. si470x_usb_driver_probe() calls si470x_start_usb(), which then calls usb_submit_urb() and si470x_start(). If si470x_start_usb() fails, si470x_usb_driver_probe() doesn't kill urb, but it just frees struct si470x_device object, as depicted below: si470x_usb_driver_probe() ... si470x_start_usb() ... usb_submit_urb() retval = si470x_start() return retval if (retval < 0) free struct si470x_device object, but don't kill urb This patch fixes this issue by killing urb when si470x_start_usb() fails and urb is submitted. If si470x_start_usb() fails and urb is not submitted, i.e. submitting usb fails, it just frees struct si470x_device object. Added Reference https://git.kernel.org/stable/c/0ca298d548461d29615f9a2b1309e8dcf4a352c6 Added Reference https://git.kernel.org/stable/c/146bd005ebb01ae190c22af050cb98623958c373 Added Reference https://git.kernel.org/stable/c/1c6447d0fc68650e51586dde79b5090d9d77f13a Added Reference https://git.kernel.org/stable/c/52f54fe78cca24850a30865037250f63eb3d5bf7 Added Reference https://git.kernel.org/stable/c/63648a7bd1a7599bcc2040a6d1792363ae4c2e1b Added Reference https://git.kernel.org/stable/c/6c8aee0c8fcc6dda94315f7908e8fa9bc75abe75 Added Reference https://git.kernel.org/stable/c/7d21e0b1b41b21d628bf2afce777727bd4479aa5 Added Reference https://git.kernel.org/stable/c/8c6151b8e8dd2d98ad2cd725d26d1e103d989891 Added Reference https://git.kernel.org/stable/c/92b0888398e4ba51d93b618a6506781f4e3879c9