CVE-2022-50499
published 2025-10-04CVE-2022-50499: In the Linux kernel, the following vulnerability has been resolved: media: dvb-core: Fix double free in dvb_register_device() In function dvb_register_device()…
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.15%
5.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
media: dvb-core: Fix double free in dvb_register_device()
In function dvb_register_device() -> dvb_register_media_device() ->
dvb_create_media_entity(), dvb->entity is allocated and initialized. If
the initialization fails, it frees the dvb->entity, and return an error
code. The caller takes the error code and handles the error by calling
dvb_media_device_free(), which unregisters the entity and frees the
field again if it is not NULL. As dvb->entity may not NULLed in
dvb_create_media_entity() when the allocation of dvbdev->pad fails, a
double free may occur. This may also cause an Use After free in
media_device_unregister_entity().
Fix this by storing NULL to dvb->entity when it is freed.
Affected
31 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.4-1 (bookworm) | linux 6.1.4-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 1399a136127bfe1b9bb7c951d9851da62a519121 < e9a78485b658361fab6a5547377be6c1af6f1b3d | e9a78485b658361fab6a5547377be6c1af6f1b3d |
| linux | linux | >= 4.14.147 < 4.14.303 | 4.14.303 |
| linux | linux | >= 4.19.77 < 4.19.270 | 4.19.270 |
| linux | linux | >= 4.9.195 < 4.9.337 | 4.9.337 |
| linux | linux | >= 4df2427a5148093987437054bb82da4d014dcd59 < 70bc51303871159796b55ba1a8f16637b46c2511 | 70bc51303871159796b55ba1a8f16637b46c2511 |
| linux | linux | >= 5.2.19 < 5.3 | 5.3 |
| linux | linux | >= 5.3.4 < 5.4 | 5.4 |
| linux | linux | >= 9db28659aa893c68f162b11fd63bb7f6a713e52f < 0588b12c418c3e4f927ced11f27b02ef4a5bfb07 | 0588b12c418c3e4f927ced11f27b02ef4a5bfb07 |
| linux | linux | >= fcd5ce4b3936242e6679875a4d3c3acfc8743e15 < b21f62b49ee9c3e0216d685d9cfd6003e5727271 | b21f62b49ee9c3e0216d685d9cfd6003e5727271 |
| linux | linux | >= fcd5ce4b3936242e6679875a4d3c3acfc8743e15 < 7dd5a68cdbbbe7fc67ba701cb52ba10d8ba149f8 | 7dd5a68cdbbbe7fc67ba701cb52ba10d8ba149f8 |
| linux | linux | >= fcd5ce4b3936242e6679875a4d3c3acfc8743e15 < acf984a3718c2458eb9e08b6714490a04f213c58 | acf984a3718c2458eb9e08b6714490a04f213c58 |
| linux | linux | >= fcd5ce4b3936242e6679875a4d3c3acfc8743e15 < 772892b29ac50c2c5e918fc80104aa6ede81d837 | 772892b29ac50c2c5e918fc80104aa6ede81d837 |
| linux | linux | >= fcd5ce4b3936242e6679875a4d3c3acfc8743e15 < 123eddf92a114e03919942641d2c2b1f4ca56ea6 | 123eddf92a114e03919942641d2c2b1f4ca56ea6 |
| linux | linux | >= fcd5ce4b3936242e6679875a4d3c3acfc8743e15 < 6b0d0477fce747d4137aa65856318b55fba72198 | 6b0d0477fce747d4137aa65856318b55fba72198 |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 4.14.147 < 4.14.303 | 4.14.303 |
| linux | linux_kernel | >= 4.19.77 < 4.19.270 | 4.19.270 |
| linux | linux_kernel | >= 4.9.195 < 4.9.337 | 4.9.337 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2022-50499: In the Linux kernel, the following vulnerability has been resolved: media: dvb-core: Fix double free in dvb_register_device() In function dvb_register
osv·2025-10-04·CVSS 7.8
CVE-2022-50499 [HIGH] CVE-2022-50499: In the Linux kernel, the following vulnerability has been resolved: media: dvb-core: Fix double free in dvb_register_device() In function dvb_register
In the Linux kernel, the following vulnerability has been resolved: media: dvb-core: Fix double free in dvb_register_device() In function dvb_register_device() -> dvb_register_media_device() -> dvb_create_media_entity(), dvb->entity is allocated and initialized. If the initialization fails, it frees the dvb->entity, and return an error code. The caller takes the error code and handles the error by calling dvb_media_device_free(), which unregisters the entity and frees the field again if it is not NULL. As dvb->entity may not NULLed in dvb_create_media_entity() when the allocation of dvbdev->pad fails, a double free may occur. This may also cause an Use After free in media_device_unregister_entity(). Fix this by storing NULL to dvb->entity when it is freed.
GHSA
GHSA-vw72-9rh3-2576: In the Linux kernel, the following vulnerability has been resolved:
media: dvb-core: Fix double free in dvb_register_device()
In function dvb_regist
ghsa_unreviewed·2025-10-04
CVE-2022-50499 [HIGH] CWE-415 GHSA-vw72-9rh3-2576: In the Linux kernel, the following vulnerability has been resolved:
media: dvb-core: Fix double free in dvb_register_device()
In function dvb_regist
In the Linux kernel, the following vulnerability has been resolved:
media: dvb-core: Fix double free in dvb_register_device()
In function dvb_register_device() -> dvb_register_media_device() ->
dvb_create_media_entity(), dvb->entity is allocated and initialized. If
the initialization fails, it frees the dvb->entity, and return an error
code. The caller takes the error code and handles the error by calling
dvb_media_device_free(), which unregisters the entity and frees the
field again if it is not NULL. As dvb->entity may not NULLed in
dvb_create_media_entity() when the allocation of dvbdev->pad fails, a
double free may occur. This may also cause an Use After free in
media_device_unregister_entity().
Fix this by storing NULL to dvb->entity when it is freed.
Red Hat
kernel: media: dvb-core: Fix double free in dvb_register_device()
vendor_redhat·2025-10-04·CVSS 7.8
CVE-2022-50499 [HIGH] kernel: media: dvb-core: Fix double free in dvb_register_device()
kernel: media: dvb-core: Fix double free in dvb_register_device()
In the Linux kernel, the following vulnerability has been resolved:
media: dvb-core: Fix double free in dvb_register_device()
In function dvb_register_device() -> dvb_register_media_device() ->
dvb_create_media_entity(), dvb->entity is allocated and initialized. If
the initialization fails, it frees the dvb->entity, and return an error
code. The caller takes the error code and handles the error by calling
dvb_media_device_free(), which unregisters the entity and frees the
field again if it is not NULL. As dvb->entity may not NULLed in
dvb_create_media_entity() when the allocation of dvbdev->pad fails, a
double free may occur. This may also cause an Use After free in
media_device_unregister_entity().
Fix this by storing NULL
Debian
CVE-2022-50499: linux - In the Linux kernel, the following vulnerability has been resolved: media: dvb-...
vendor_debian·2022·CVSS 7.8
CVE-2022-50499 [HIGH] CVE-2022-50499: linux - In the Linux kernel, the following vulnerability has been resolved: media: dvb-...
In the Linux kernel, the following vulnerability has been resolved: media: dvb-core: Fix double free in dvb_register_device() In function dvb_register_device() -> dvb_register_media_device() -> dvb_create_media_entity(), dvb->entity is allocated and initialized. If the initialization fails, it frees the dvb->entity, and return an error code. The caller takes the error code and handles the error by calling dvb_media_device_free(), which unregisters the entity and frees the field again if it is not NULL. As dvb->entity may not NULLed in dvb_create_media_entity() when the allocation of dvbdev->pad fails, a double free may occur. This may also cause an Use After free in media_device_unregister_entity(). Fix this by storing NULL to dvb->entity when it is freed.
Scope: local
bookworm: resolved (
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0588b12c418c3e4f927ced11f27b02ef4a5bfb07https://git.kernel.org/stable/c/123eddf92a114e03919942641d2c2b1f4ca56ea6https://git.kernel.org/stable/c/6b0d0477fce747d4137aa65856318b55fba72198https://git.kernel.org/stable/c/70bc51303871159796b55ba1a8f16637b46c2511https://git.kernel.org/stable/c/772892b29ac50c2c5e918fc80104aa6ede81d837https://git.kernel.org/stable/c/7dd5a68cdbbbe7fc67ba701cb52ba10d8ba149f8https://git.kernel.org/stable/c/acf984a3718c2458eb9e08b6714490a04f213c58https://git.kernel.org/stable/c/b21f62b49ee9c3e0216d685d9cfd6003e5727271https://git.kernel.org/stable/c/e9a78485b658361fab6a5547377be6c1af6f1b3d
2025-10-04
Published