CVE-2022-50229

ALSA: bcd2000: Fix a UAF bug on the error path of probing

State: Published
Severity: Not scored
Published: Jun 18, 2025
Updated: May 11, 2026
Reserved: Jun 18, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: bcd2000: Fix a UAF bug on the error path of probing

When the driver fails in snd_card_register() at probe time, it will free the 'bcd2k->midi_out_urb' before killing it, which may cause a UAF bug.

The following log can reveal it:

[ 50.727020] BUG: KASAN: use-after-free in bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000] [ 50.727623] Read of size 8 at addr ffff88810fab0e88 by task swapper/4/0 [ 50.729530] Call Trace: [ 50.732899] bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000]

Fix this by adding usb_kill_urb() before usb_free_urb().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	b47a22290d581277be70e8a597824a4985d39e83 to before a718eba7e458e2f40531be3c6b6a0028ca7fcaceAffected b47a22290d581277be70e8a597824a4985d39e83 to before 4fc41f7ebb7efca282f1740ea934d16f33c1d109Affected b47a22290d581277be70e8a597824a4985d39e83 to before 5e7338f4dd92b2f8915a82abfa1dd3ad3464bea0Affected b47a22290d581277be70e8a597824a4985d39e83 to before 05e0bb8c3c4dde3e21b9c1cf9395afb04e8b24dbAffected b47a22290d581277be70e8a597824a4985d39e83 to before 348620464a5c127399ac09b266f494f393661952Affected b47a22290d581277be70e8a597824a4985d39e83 to before 64ca7f50ad96c2c65ae390b954925a36eabe04aaAffected b47a22290d581277be70e8a597824a4985d39e83 to before 1d6a246cf97c380f2da76591f03019dd9c9599c3Affected b47a22290d581277be70e8a597824a4985d39e83 to before b0d4af0a4763ddc02344789ef2a281c494bc330dAffected b47a22290d581277be70e8a597824a4985d39e83 to before ffb2759df7efbc00187bfd9d1072434a13a54139Affected
LinuxLinux	3.16Affected before 3.16Not affected 4.9.326 through 4.9.Not affected 4.14.291 through 4.14.Not affected 4.19.256 through 4.19.Not affected 5.4.211 through 5.4.Not affected 5.10.137 through 5.10.Not affected 5.15.61 through 5.15.Not affected 5.18.18 through 5.18.Not affected 5.19.2 through 5.19.Not affected 6.0 and laterNot affected

Product

Versions

LinuxLinux

b47a22290d581277be70e8a597824a4985d39e83 to before a718eba7e458e2f40531be3c6b6a0028ca7fcaceAffected
b47a22290d581277be70e8a597824a4985d39e83 to before 4fc41f7ebb7efca282f1740ea934d16f33c1d109Affected
b47a22290d581277be70e8a597824a4985d39e83 to before 5e7338f4dd92b2f8915a82abfa1dd3ad3464bea0Affected
b47a22290d581277be70e8a597824a4985d39e83 to before 05e0bb8c3c4dde3e21b9c1cf9395afb04e8b24dbAffected
b47a22290d581277be70e8a597824a4985d39e83 to before 348620464a5c127399ac09b266f494f393661952Affected
b47a22290d581277be70e8a597824a4985d39e83 to before 64ca7f50ad96c2c65ae390b954925a36eabe04aaAffected
b47a22290d581277be70e8a597824a4985d39e83 to before 1d6a246cf97c380f2da76591f03019dd9c9599c3Affected
b47a22290d581277be70e8a597824a4985d39e83 to before b0d4af0a4763ddc02344789ef2a281c494bc330dAffected
b47a22290d581277be70e8a597824a4985d39e83 to before ffb2759df7efbc00187bfd9d1072434a13a54139Affected

LinuxLinux

3.16Affected
before 3.16Not affected
4.9.326 through 4.9.*Not affected
4.14.291 through 4.14.*Not affected
4.19.256 through 4.19.*Not affected
5.4.211 through 5.4.*Not affected
5.10.137 through 5.10.*Not affected
5.15.61 through 5.15.*Not affected
5.18.18 through 5.18.*Not affected
5.19.2 through 5.19.*Not affected
6.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.