CVE-2022-50419 — Double Free in Linux

CWE-415 — Double FreeCWE-672 — Operation on a Resource after Expiration or Release5 documents5 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 97.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
LinuxLinux KernelDebian Linux
Timeline
PublishedSep 18

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times device_add shall not be called multiple times as stated in its documentation: 'Do not call this routine or device_register() more than once for any device structure' Syzkaller reports a bug as follows [1]: ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:33! invalid opcode: 0000 [#1] PREEMPT SMP KASAN [...] Call Trace: __list_add inclu…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶NVDlinux/linux_kernel2.6.19 — 4.9.331+7
▶Debianlinux/linux_kernel< 5.10.158-1+3
▶CVEListV5linux/linuxb219e3ac66183fc9771b94af931fb5fd41d586ec — 4bcefec3636208b4c97536b26014d5935d5c10a0+9
▶debiandebian/linux< linux 6.0.3-1 (bookworm)

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-4pjv-phcw-v7cc: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times device_ad↗2025-09-18
▶
OSV
CVE-2022-50419: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times device_add↗2025-09-18
▶

📋Vendor Advisories

2
Red Hat
kernel: Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times↗2025-09-18
▶
Debian
CVE-2022-50419: linux - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ...↗2022
▶
CVE-2022-50419 — Double Free in Linux | cvebase