CVE-2022-50274

media: dvbdev: adopts refcnt to avoid UAF

State: Published
Severity: 7.8 High
Published: Sep 15, 2025
Updated: Aug 5, 2026
Reserved: Sep 15, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

media: dvbdev: adopts refcnt to avoid UAF

dvb_unregister_device() is known that prone to use-after-free. That is, the cleanup from dvb_unregister_device() releases the dvb_device even if there are pointers stored in file->private_data still refer to it.

This patch adds a reference counter into struct dvb_device and delays its deallocation until no pointer refers to the object.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ac521bbe3d00fa574e66a9361763f2b37725bc97Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 219b44bf94203bd433aa91b7796475bf656348e5Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6d18b44bb44e1f4d97dfe0efe92ac0f0984739c2Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2abd73433872194bccdf1432a0980e4ec5273c2aAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 88a6f8a72d167294c0931c7874941bf37a41b6ddAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a2f0a08aa613176c9688c81d7b598a7779974991Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 9945d05d6693710574f354c5dbddc47f5101eb77Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 0fc044b2b5e2d05a1fa1fb0d7f270367a7855d79Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 4.14.303 through 4.14.Not affected 4.19.270 through 4.19.Not affected 5.4.229 through 5.4.Not affected 5.10.163 through 5.10.Not affected 5.15.86 through 5.15.Not affected 6.0.16 through 6.0.Not affected 6.1.2 through 6.1.*Not affected 6.2 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ac521bbe3d00fa574e66a9361763f2b37725bc97Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 219b44bf94203bd433aa91b7796475bf656348e5Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6d18b44bb44e1f4d97dfe0efe92ac0f0984739c2Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2abd73433872194bccdf1432a0980e4ec5273c2aAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 88a6f8a72d167294c0931c7874941bf37a41b6ddAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a2f0a08aa613176c9688c81d7b598a7779974991Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 9945d05d6693710574f354c5dbddc47f5101eb77Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 0fc044b2b5e2d05a1fa1fb0d7f270367a7855d79Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
4.14.303 through 4.14.*Not affected
4.19.270 through 4.19.*Not affected
5.4.229 through 5.4.*Not affected
5.10.163 through 5.10.*Not affected
5.15.86 through 5.15.*Not affected
6.0.16 through 6.0.*Not affected
6.1.2 through 6.1.*Not affected
6.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.