Riskcovery

CVE-2022-50421

rpmsg: char: Avoid double destroy of default endpoint

State
Published
Severity
7.8 High
Published
Oct 1, 2025
Updated
Aug 5, 2026
Reserved
Sep 17, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

rpmsg: char: Avoid double destroy of default endpoint

The rpmsg_dev_remove() in rpmsg_core is the place for releasing this default endpoint.

So need to avoid destroying the default endpoint in rpmsg_chrdev_eptdev_destroy(), this should be the same as rpmsg_eptdev_release(). Otherwise there will be double destroy issue that ept->refcount report warning:

refcount_t: underflow; use-after-free.

Call trace: refcount_warn_saturate+0xf8/0x150 virtio_rpmsg_destroy_ept+0xd4/0xec rpmsg_dev_remove+0x60/0x70

The issue can be reproduced by stopping remoteproc before closing the /dev/rpmsgX.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCISA-ADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • bea9b79c2d10fecf7bfa26e212ecefe61d232e39 to before ef828a39d6a7028836eaf37df3ad568c8c2dd6f9Affected
  • bea9b79c2d10fecf7bfa26e212ecefe61d232e39 to before 3f20ef7a845c2c8d7ec82ecffa20d95cab5ecfebAffected
  • bea9b79c2d10fecf7bfa26e212ecefe61d232e39 to before 467233a4ac29b215d492843d067a9f091e6bf0c5Affected
LinuxLinux
  • 5.18Affected
  • before 5.18Not affected
  • 5.19.17 through 5.19.*Not affected
  • 6.0.3 through 6.0.*Not affected
  • 6.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.