CVE-2022-50214
published 2025-06-18CVE-2022-50214: In the Linux kernel, the following vulnerability has been resolved: coresight: Clear the connection field properly coresight devices track their connections…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.19%
9.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
coresight: Clear the connection field properly
coresight devices track their connections (output connections) and
hold a reference to the fwnode. When a device goes away, we walk through
the devices on the coresight bus and make sure that the references
are dropped. This happens both ways:
a) For all output connections from the device, drop the reference to
the target device via coresight_release_platform_data()
b) Iterate over all the devices on the coresight bus and drop the
reference to fwnode if *this* device is the target of the output
connection, via coresight_remove_conns()->coresight_remove_match().
However, the coresight_remove_match() doesn't clear the fwnode field,
after dropping the reference, this causes use-after-free and
additional refcount drops on the fwnode.
e.g., if we have two devices, A and B, with a connection, A -> B.
If we remove B first, B would clear the reference on B, from A
via coresight_remove_match(). But when A is removed, it still has
a connection with fwnode still pointing to B. Thus it tries to drops
the reference in coresight_release_platform_data(), raising the bells
like :
[ 91.990153] ------------[ cut here ]------------
[ 91.990163] refcount_t: addition on 0; use-after-free.
[ 91.990212] WARNING: CPU: 0 PID: 461 at lib/refcount.c:25 refcount_warn_saturate+0xa0/0x144
[ 91.990260] Modules linked in: coresight_funnel coresight_replicator coresight_etm4x(-)
crct10dif_ce coresight ip_tables x_tables ipv6 [last unloaded: coresight_cpu_debug]
[ 91.990398] CPU: 0 PID: 461 Comm: rmmod Tainted: G W T 5.19.0-rc2+ #53
[ 91.990418] Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Feb 1 2019
[ 91.990434] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 91.990454] pc : refcount_warn_saturate+0xa0/0x144
[ 91.990476] lr : refcount_warn_saturate+0xa0/0x144
[ 91.990496] sp : ffff80000c843640
[ 91.990509] x29:
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.2-1 (bookworm) | linux 6.0.2-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 37ea1ffddffa63c920ce826786fe610c78f57842 < e9205d8dd1cafb7cff689ef9ddf06276a68f54a4 | e9205d8dd1cafb7cff689ef9ddf06276a68f54a4 |
| linux | linux | >= 37ea1ffddffa63c920ce826786fe610c78f57842 < 847b9273dd61567fb77617eabc5fa002594db062 | 847b9273dd61567fb77617eabc5fa002594db062 |
| linux | linux | >= 37ea1ffddffa63c920ce826786fe610c78f57842 < b49b29ee113a87997bcca0bb0585bb46582846c1 | b49b29ee113a87997bcca0bb0585bb46582846c1 |
| linux | linux | >= 37ea1ffddffa63c920ce826786fe610c78f57842 < d43e967963c4d1b2b49f894d2f1b12865f87b098 | d43e967963c4d1b2b49f894d2f1b12865f87b098 |
| linux | linux | >= 37ea1ffddffa63c920ce826786fe610c78f57842 < bc57850fcb7e4cb91b6321d0ce83357cefd55c54 | bc57850fcb7e4cb91b6321d0ce83357cefd55c54 |
| linux | linux | >= 37ea1ffddffa63c920ce826786fe610c78f57842 < 2af89ebacf299b7fba5f3087d35e8a286ec33706 | 2af89ebacf299b7fba5f3087d35e8a286ec33706 |
| linux | linux_kernel | >= 0 < 5.10.140-1 | 5.10.140-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 5.11 < 5.15.61 | 5.15.61 |
| linux | linux_kernel | >= 5.16 < 5.18.18 | 5.18.18 |
| linux | linux_kernel | >= 5.19 < 5.19.2 | 5.19.2 |
| linux | linux_kernel | >= 5.3 < 5.4.211 | 5.4.211 |
| linux | linux_kernel | >= 5.5 < 5.10.137 | 5.10.137 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: coresight: Clear the connection field properly
vendor_redhat·2025-06-18·CVSS 7.8
CVE-2022-50214 [HIGH] CWE-825 kernel: coresight: Clear the connection field properly
kernel: coresight: Clear the connection field properly
In the Linux kernel, the following vulnerability has been resolved:
coresight: Clear the connection field properly
coresight devices track their connections (output connections) and
hold a reference to the fwnode. When a device goes away, we walk through
the devices on the coresight bus and make sure that the references
are dropped. This happens both ways:
a) For all output connections from the device, drop the reference to
the target device via coresight_release_platform_data()
b) Iterate over all the devices on the coresight bus and drop the
reference to fwnode if *this* device is the target of the output
connection, via coresight_remove_conns()->coresight_remove_match().
However, the coresight_remove_match() doesn't clear the fwnod
Debian
CVE-2022-50214: linux - In the Linux kernel, the following vulnerability has been resolved: coresight: ...
vendor_debian·2022·CVSS 7.8
CVE-2022-50214 [HIGH] CVE-2022-50214: linux - In the Linux kernel, the following vulnerability has been resolved: coresight: ...
In the Linux kernel, the following vulnerability has been resolved: coresight: Clear the connection field properly coresight devices track their connections (output connections) and hold a reference to the fwnode. When a device goes away, we walk through the devices on the coresight bus and make sure that the references are dropped. This happens both ways: a) For all output connections from the device, drop the reference to the target device via coresight_release_platform_data() b) Iterate over all the devices on the coresight bus and drop the reference to fwnode if *this* device is the target of the output connection, via coresight_remove_conns()->coresight_remove_match(). However, the coresight_remove_match() doesn't clear the fwnode field, after dropping the reference, this causes use-a
GHSA
GHSA-c35q-x63g-2qfh: In the Linux kernel, the following vulnerability has been resolved:
coresight: Clear the connection field properly
coresight devices track their con
ghsa_unreviewed·2025-06-18
CVE-2022-50214 [HIGH] CWE-416 GHSA-c35q-x63g-2qfh: In the Linux kernel, the following vulnerability has been resolved:
coresight: Clear the connection field properly
coresight devices track their con
In the Linux kernel, the following vulnerability has been resolved:
coresight: Clear the connection field properly
coresight devices track their connections (output connections) and
hold a reference to the fwnode. When a device goes away, we walk through
the devices on the coresight bus and make sure that the references
are dropped. This happens both ways:
a) For all output connections from the device, drop the reference to
the target device via coresight_release_platform_data()
b) Iterate over all the devices on the coresight bus and drop the
reference to fwnode if *this* device is the target of the output
connection, via coresight_remove_conns()->coresight_remove_match().
However, the coresight_remove_match() doesn't clear the fwnode field,
after dropping the reference, this causes u
OSV
CVE-2022-50214: In the Linux kernel, the following vulnerability has been resolved: coresight: Clear the connection field properly coresight devices track their conne
osv·2025-06-18·CVSS 7.8
CVE-2022-50214 [HIGH] CVE-2022-50214: In the Linux kernel, the following vulnerability has been resolved: coresight: Clear the connection field properly coresight devices track their conne
In the Linux kernel, the following vulnerability has been resolved: coresight: Clear the connection field properly coresight devices track their connections (output connections) and hold a reference to the fwnode. When a device goes away, we walk through the devices on the coresight bus and make sure that the references are dropped. This happens both ways: a) For all output connections from the device, drop the reference to the target device via coresight_release_platform_data() b) Iterate over all the devices on the coresight bus and drop the reference to fwnode if *this* device is the target of the output connection, via coresight_remove_conns()->coresight_remove_match(). However, the coresight_remove_match() doesn't clear the fwnode field, after dropping the reference, this causes use-a
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/2af89ebacf299b7fba5f3087d35e8a286ec33706https://git.kernel.org/stable/c/847b9273dd61567fb77617eabc5fa002594db062https://git.kernel.org/stable/c/b49b29ee113a87997bcca0bb0585bb46582846c1https://git.kernel.org/stable/c/bc57850fcb7e4cb91b6321d0ce83357cefd55c54https://git.kernel.org/stable/c/d43e967963c4d1b2b49f894d2f1b12865f87b098https://git.kernel.org/stable/c/e9205d8dd1cafb7cff689ef9ddf06276a68f54a4
2025-06-18
Published