{"id":"DEBIAN-CVE-2022-50378","details":"In the Linux kernel, the following vulnerability has been resolved:  drm/meson: reorder driver deinit sequence to fix use-after-free bug  Unloading the driver triggers the following KASAN warning:  [  +0.006275] ============================================================= [  +0.000029] BUG: KASAN: use-after-free in __list_del_entry_valid+0xe0/0x1a0 [  +0.000026] Read of size 8 at addr ffff000020c395e0 by task rmmod/2695  [  +0.000019] CPU: 5 PID: 2695 Comm: rmmod Tainted: G         C O      5.19.0-rc6-lrmbkasan+ #1 [  +0.000013] Hardware name: Hardkernel ODROID-N2Plus (DT) [  +0.000008] Call trace: [  +0.000007]  dump_backtrace+0x1ec/0x280 [  +0.000013]  show_stack+0x24/0x80 [  +0.000008]  dump_stack_lvl+0x98/0xd4 [  +0.000011]  print_address_description.constprop.0+0x80/0x520 [  +0.000011]  print_report+0x128/0x260 [  +0.000007]  kasan_report+0xb8/0xfc [  +0.000008]  __asan_report_load8_noabort+0x3c/0x50 [  +0.000010]  __list_del_entry_valid+0xe0/0x1a0 [  +0.000009]  drm_atomic_private_obj_fini+0x30/0x200 [drm] [  +0.000172]  drm_bridge_detach+0x94/0x260 [drm] [  +0.000145]  drm_encoder_cleanup+0xa4/0x290 [drm] [  +0.000144]  drm_mode_config_cleanup+0x118/0x740 [drm] [  +0.000143]  drm_mode_config_init_release+0x1c/0x2c [drm] [  +0.000144]  drm_managed_release+0x170/0x414 [drm] [  +0.000142]  drm_dev_put.part.0+0xc0/0x124 [drm] [  +0.000143]  drm_dev_put+0x20/0x30 [drm] [  +0.000142]  meson_drv_unbind+0x1d8/0x2ac [meson_drm] [  +0.000028]  take_down_aggregate_device+0xb0/0x160 [  +0.000016]  component_del+0x18c/0x360 [  +0.000009]  meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi] [  +0.000015]  platform_remove+0x64/0xb0 [  +0.000009]  device_remove+0xb8/0x154 [  +0.000009]  device_release_driver_internal+0x398/0x5b0 [  +0.000009]  driver_detach+0xac/0x1b0 [  +0.000009]  bus_remove_driver+0x158/0x29c [  +0.000009]  driver_unregister+0x70/0xb0 [  +0.000008]  platform_driver_unregister+0x20/0x2c [  +0.000008]  meson_dw_hdmi_platform_driver_exit+0x1c/0x30 [meson_dw_hdmi] [  +0.000012]  __do_sys_delete_module+0x288/0x400 [  +0.000011]  __arm64_sys_delete_module+0x5c/0x80 [  +0.000009]  invoke_syscall+0x74/0x260 [  +0.000009]  el0_svc_common.constprop.0+0xcc/0x260 [  +0.000009]  do_el0_svc+0x50/0x70 [  +0.000007]  el0_svc+0x68/0x1a0 [  +0.000012]  el0t_64_sync_handler+0x11c/0x150 [  +0.000008]  el0t_64_sync+0x18c/0x190  [  +0.000018] Allocated by task 0: [  +0.000007] (stack is not available)  [  +0.000011] Freed by task 2695: [  +0.000008]  kasan_save_stack+0x2c/0x5c [  +0.000011]  kasan_set_track+0x2c/0x40 [  +0.000008]  kasan_set_free_info+0x28/0x50 [  +0.000009]  ____kasan_slab_free+0x128/0x1d4 [  +0.000008]  __kasan_slab_free+0x18/0x24 [  +0.000007]  slab_free_freelist_hook+0x108/0x230 [  +0.000011]  kfree+0x110/0x35c [  +0.000008]  release_nodes+0xf0/0x16c [  +0.000009]  devres_release_group+0x180/0x270 [  +0.000008]  component_unbind+0x128/0x1e0 [  +0.000010]  component_unbind_all+0x1b8/0x264 [  +0.000009]  meson_drv_unbind+0x1a0/0x2ac [meson_drm] [  +0.000025]  take_down_aggregate_device+0xb0/0x160 [  +0.000009]  component_del+0x18c/0x360 [  +0.000009]  meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi] [  +0.000012]  platform_remove+0x64/0xb0 [  +0.000008]  device_remove+0xb8/0x154 [  +0.000009]  device_release_driver_internal+0x398/0x5b0 [  +0.000009]  driver_detach+0xac/0x1b0 [  +0.000009]  bus_remove_driver+0x158/0x29c [  +0.000008]  driver_unregister+0x70/0xb0 [  +0.000008]  platform_driver_unregister+0x20/0x2c [  +0.000008]  meson_dw_hdmi_platform_driver_exit+0x1c/0x30 [meson_dw_hdmi] [  +0.000011]  __do_sys_delete_module+0x288/0x400 [  +0.000010]  __arm64_sys_delete_module+0x5c/0x80 [  +0.000008]  invoke_syscall+0x74/0x260 [  +0.000008]  el0_svc_common.constprop.0+0xcc/0x260 [  +0.000008]  do_el0_svc+0x50/0x70 [  +0.000007]  el0_svc+0x68/0x1a0 [  +0.000009]  el0t_64_sync_handler+0x11c/0x150 [  +0.000009]  el0t_64_sync+0x18c/0x190  [  +0.000014] The buggy address belongs to the object at ffff000020c39000 ---truncated---","modified":"2026-09-01T16:05:35.043483735Z","published":"2025-09-18T14:15:36.513Z","upstream":["CVE-2022-50378"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2022-50378"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.3-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50378.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.3-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50378.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.3-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50378.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}