CVE-2022-50412
BaseFortify
Publication date: 2025-09-18
Last updated on: 2025-12-12
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 4.15 (inc) to 5.10.234 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.75 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 5.19.17 (exc) |
| linux | linux_kernel | From 6.0 (inc) to 6.0.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's drm bridge driver for adv7511. The issue is that the function cec_unregister_adapter() assumes the underlying adapter operations are callable. When the adv7511 module is removed, the unregistration procedure invalidates the physical address, leading to a kernel oops (crash) due to a null pointer dereference. This happens because the i2c CEC device is unregistered before the CEC adapter, causing improper handling and a kernel error. The fix involves unregistering the i2c CEC device after unregistering the CEC adapter and disabling the CEC clock afterwards.
How can this vulnerability impact me? :
This vulnerability can cause a kernel crash (kernel oops) when the adv7511 module is removed, potentially leading to system instability or denial of service. It affects the reliability of the system by causing unexpected kernel errors during device removal operations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing kernel oops or crash logs related to the adv7511 module, specifically errors indicating issues in cec_unregister_adapter() such as 'Unable to handle kernel execution of user memory at virtual address 0000000000000000' and related call traces involving adv7511 and cec functions. You can check the kernel logs using commands like 'dmesg | grep adv7511' or 'journalctl -k | grep adv7511' to identify such errors.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that the i2c_cec device is unregistered only after the CEC adapter has been unregistered. Additionally, disable the CEC clock after unregistering the i2c_cec device. This prevents the kernel oops caused by invalid physical address handling during module removal.