{"id":"DEBIAN-CVE-2022-50423","details":"In the Linux kernel, the following vulnerability has been resolved:  ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()  There is an use-after-free reported by KASAN:    BUG: KASAN: use-after-free in acpi_ut_remove_reference+0x3b/0x82   Read of size 1 at addr ffff888112afc460 by task modprobe/2111   CPU: 0 PID: 2111 Comm: modprobe Not tainted 6.1.0-rc7-dirty   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),   Call Trace:    \u003cTASK\u003e    kasan_report+0xae/0xe0    acpi_ut_remove_reference+0x3b/0x82    acpi_ut_copy_iobject_to_iobject+0x3be/0x3d5    acpi_ds_store_object_to_local+0x15d/0x3a0    acpi_ex_store+0x78d/0x7fd    acpi_ex_opcode_1A_1T_1R+0xbe4/0xf9b    acpi_ps_parse_aml+0x217/0x8d5    ...    \u003c/TASK\u003e  The root cause of the problem is that the acpi_operand_object is freed when acpi_ut_walk_package_tree() fails in acpi_ut_copy_ipackage_to_ipackage(), lead to repeated release in acpi_ut_copy_iobject_to_iobject(). The problem was introduced by \"8aa5e56eeb61\" commit, this commit is to fix memory leak in acpi_ut_copy_iobject_to_iobject(), repeatedly adding remove operation, lead to \"acpi_operand_object\" used after free.  Fix it by removing acpi_ut_remove_reference() in acpi_ut_copy_ipackage_to_ipackage(). acpi_ut_copy_ipackage_to_ipackage() is called to copy an internal package object into another internal package object, when it fails, the memory of acpi_operand_object should be freed by the caller.","modified":"2026-09-01T16:05:35.134105267Z","published":"2025-10-01T12:15:33.683Z","upstream":["CVE-2022-50423"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2022-50423"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50423.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50423.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50423.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}