CVE-2022-50087

firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails

State: Published
Severity: 7.8 High
Published: Jun 18, 2025
Updated: Aug 5, 2026
Reserved: Jun 18, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails

When scpi probe fails, at any point, we need to ensure that the scpi_info is not set and will remain NULL until the probe succeeds. If it is not taken care, then it could result use-after-free as the value is exported via get_scpi_ops() and could refer to a memory allocated via devm_kzalloc() but freed when the probe fails.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8cb7cf56c9fe5412de238465b27ef35b4d2801aa to before 5aa558232edc30468d1f35108826dd5b3ffe978fAffected 8cb7cf56c9fe5412de238465b27ef35b4d2801aa to before 18048cba444a7c41dbf42c180d6b46606fc24c51Affected 8cb7cf56c9fe5412de238465b27ef35b4d2801aa to before 08272646cd7c310642c39b7f54348fddd7987643Affected 8cb7cf56c9fe5412de238465b27ef35b4d2801aa to before 0c29e149b6bb498778ed8a1c9597b51acfba7856Affected 8cb7cf56c9fe5412de238465b27ef35b4d2801aa to before 87c4896d5dd7fd9927c814cf3c6289f41de3b562Affected 8cb7cf56c9fe5412de238465b27ef35b4d2801aa to before 4f2d7b46d6b53c07f44a4f8f8f4438888f0e9e87Affected 8cb7cf56c9fe5412de238465b27ef35b4d2801aa to before 689640efc0a2c4e07e6f88affe6d42cd40cc3f85Affected
LinuxLinux	4.4Affected before 4.4Not affected 4.19.256 through 4.19.Not affected 5.4.211 through 5.4.Not affected 5.10.137 through 5.10.Not affected 5.15.61 through 5.15.Not affected 5.18.18 through 5.18.Not affected 5.19.2 through 5.19.Not affected 6.0 and laterNot affected

Product

Versions

LinuxLinux

8cb7cf56c9fe5412de238465b27ef35b4d2801aa to before 5aa558232edc30468d1f35108826dd5b3ffe978fAffected
8cb7cf56c9fe5412de238465b27ef35b4d2801aa to before 18048cba444a7c41dbf42c180d6b46606fc24c51Affected
8cb7cf56c9fe5412de238465b27ef35b4d2801aa to before 08272646cd7c310642c39b7f54348fddd7987643Affected
8cb7cf56c9fe5412de238465b27ef35b4d2801aa to before 0c29e149b6bb498778ed8a1c9597b51acfba7856Affected
8cb7cf56c9fe5412de238465b27ef35b4d2801aa to before 87c4896d5dd7fd9927c814cf3c6289f41de3b562Affected
8cb7cf56c9fe5412de238465b27ef35b4d2801aa to before 4f2d7b46d6b53c07f44a4f8f8f4438888f0e9e87Affected
8cb7cf56c9fe5412de238465b27ef35b4d2801aa to before 689640efc0a2c4e07e6f88affe6d42cd40cc3f85Affected

LinuxLinux

4.4Affected
before 4.4Not affected
4.19.256 through 4.19.*Not affected
5.4.211 through 5.4.*Not affected
5.10.137 through 5.10.*Not affected
5.15.61 through 5.15.*Not affected
5.18.18 through 5.18.*Not affected
5.19.2 through 5.19.*Not affected
6.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.