CVE-2022-50384

staging: vme_user: Fix possible UAF in tsi148_dma_list_add

State: Published
Severity: 7.8 High
Published: Sep 18, 2025
Updated: Aug 5, 2026
Reserved: Sep 17, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

staging: vme_user: Fix possible UAF in tsi148_dma_list_add

Smatch report warning as follows:

drivers/staging/vme_user/vme_tsi148.c:1757 tsi148_dma_list_add() warn: '&entry->list' not removed from list

In tsi148_dma_list_add(), the error path "goto err_dma" will not remove entry->list from list->entries, but entry will be freed, then list traversal may cause UAF.

Fix by removeing it from list->entries before free().

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	b2383c90a9d691201b9aee557776694cde86a935 to before 5cc4eea715a3fcf4e516662f736dfee63979465fAffected b2383c90a9d691201b9aee557776694cde86a935 to before 51c0ad3b7c5b01f9314758335a13f157b05fa56dAffected b2383c90a9d691201b9aee557776694cde86a935 to before e6b0adff99edf246ba1f8d464530a0438cb1cbdaAffected b2383c90a9d691201b9aee557776694cde86a935 to before a45ba33d398a821147d7e5f16ead7eb125e331e2Affected b2383c90a9d691201b9aee557776694cde86a935 to before 5d2b286eb034af114f67d9967fc3fbc1829bb712Affected b2383c90a9d691201b9aee557776694cde86a935 to before 1f5661388f43df3ac106ce93e67d8d22b16a78ffAffected b2383c90a9d691201b9aee557776694cde86a935 to before cf138759a7e92c75cfc1b7ba705e4108fe330edfAffected b2383c90a9d691201b9aee557776694cde86a935 to before 85db68fc901da52314ded80aace99f8b684c7815Affected b2383c90a9d691201b9aee557776694cde86a935 to before 357057ee55d3c99a5de5abe8150f7bca04f8e53bAffected
LinuxLinux	4.2Affected before 4.2Not affected 4.9.337 through 4.9.Not affected 4.14.303 through 4.14.Not affected 4.19.270 through 4.19.Not affected 5.4.229 through 5.4.Not affected 5.10.163 through 5.10.Not affected 5.15.86 through 5.15.Not affected 6.0.16 through 6.0.Not affected 6.1.2 through 6.1.Not affected 6.2 and laterNot affected

Product

Versions

LinuxLinux

b2383c90a9d691201b9aee557776694cde86a935 to before 5cc4eea715a3fcf4e516662f736dfee63979465fAffected
b2383c90a9d691201b9aee557776694cde86a935 to before 51c0ad3b7c5b01f9314758335a13f157b05fa56dAffected
b2383c90a9d691201b9aee557776694cde86a935 to before e6b0adff99edf246ba1f8d464530a0438cb1cbdaAffected
b2383c90a9d691201b9aee557776694cde86a935 to before a45ba33d398a821147d7e5f16ead7eb125e331e2Affected
b2383c90a9d691201b9aee557776694cde86a935 to before 5d2b286eb034af114f67d9967fc3fbc1829bb712Affected
b2383c90a9d691201b9aee557776694cde86a935 to before 1f5661388f43df3ac106ce93e67d8d22b16a78ffAffected
b2383c90a9d691201b9aee557776694cde86a935 to before cf138759a7e92c75cfc1b7ba705e4108fe330edfAffected
b2383c90a9d691201b9aee557776694cde86a935 to before 85db68fc901da52314ded80aace99f8b684c7815Affected
b2383c90a9d691201b9aee557776694cde86a935 to before 357057ee55d3c99a5de5abe8150f7bca04f8e53bAffected

LinuxLinux

4.2Affected
before 4.2Not affected
4.9.337 through 4.9.*Not affected
4.14.303 through 4.14.*Not affected
4.19.270 through 4.19.*Not affected
5.4.229 through 5.4.*Not affected
5.10.163 through 5.10.*Not affected
5.15.86 through 5.15.*Not affected
6.0.16 through 6.0.*Not affected
6.1.2 through 6.1.*Not affected
6.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.