CVE-2022-50767

fbdev: smscufx: Fix several use-after-free bugs

State: Published
Severity: Not scored
Published: Dec 24, 2025
Updated: May 11, 2026
Reserved: Dec 24, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

fbdev: smscufx: Fix several use-after-free bugs

Several types of UAFs can occur when physically removing a USB device.

Adds ufx_ops_destroy() function to .fb_destroy of fb_ops, and in this function, there is kref_put() that finally calls ufx_free().

This fix prevents multiple UAFs.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before 6f2075ea883e5d7730d0c9ebb1bb8e7a1a7e953fAffected 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before 3f40852d671072836fb7ae331a1f28a24223c4e8Affected 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before 70faf9d9b6cc74418716bbf76fe75bd2da10ad4aAffected 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before 5385af2f89bc352fb70753ab41b2bb036190141fAffected 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before d9ddfeb01fb95ffbbc7031d46a5ee2a5e45cbb86Affected 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before cc6a7249842fceda7574ceb63275a2d5e99d2862Affected 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before 8d924b262f3178a9b17c17d4306a9f426c508bd9Affected 3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before cc67482c9e5f2c80d62f623bcc347c29f9f648e1Affected
LinuxLinux	3.2Affected before 3.2Not affected 4.9.332 through 4.9.Not affected 4.14.298 through 4.14.Not affected 4.19.264 through 4.19.Not affected 5.4.223 through 5.4.Not affected 5.10.153 through 5.10.Not affected 5.15.77 through 5.15.Not affected 6.0.7 through 6.0.*Not affected 6.1 and laterNot affected

Product

Versions

LinuxLinux

3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before 6f2075ea883e5d7730d0c9ebb1bb8e7a1a7e953fAffected
3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before 3f40852d671072836fb7ae331a1f28a24223c4e8Affected
3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before 70faf9d9b6cc74418716bbf76fe75bd2da10ad4aAffected
3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before 5385af2f89bc352fb70753ab41b2bb036190141fAffected
3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before d9ddfeb01fb95ffbbc7031d46a5ee2a5e45cbb86Affected
3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before cc6a7249842fceda7574ceb63275a2d5e99d2862Affected
3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before 8d924b262f3178a9b17c17d4306a9f426c508bd9Affected
3c8a63e22a0802fd56380f6ab305b419f18eb6f5 to before cc67482c9e5f2c80d62f623bcc347c29f9f648e1Affected

LinuxLinux

3.2Affected
before 3.2Not affected
4.9.332 through 4.9.*Not affected
4.14.298 through 4.14.*Not affected
4.19.264 through 4.19.*Not affected
5.4.223 through 5.4.*Not affected
5.10.153 through 5.10.*Not affected
5.15.77 through 5.15.*Not affected
6.0.7 through 6.0.*Not affected
6.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.