{
  "cveId": "CVE-2022-50378",
  "url": "https://patchblox.com/security/cve/CVE-2022-50378",
  "summary": "CVE-2022-50378 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-50378, released September 18, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  drm/meson: reorder driver deinit sequence to fix...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  drm/meson: reorder driver deinit sequence to fix use-after-free bug  Unloading the driver triggers the following KASAN warning:  [  \u002B0.006275] ============================================================= [  \u002B0.000029] BUG: KASAN: use-after-free in __list_del_entry_valid\u002B0xe0/0x1a0 [  \u002B0.000026] Read of size 8 at addr ffff000020c395e0 by task rmmod/2695  [  \u002B0.000019] CPU: 5 PID: 2695 Comm: rmmod Tainted: G         C O      5.19.0-rc6-lrmbkasan\u002B #1 [  \u002B0.000013] Hardware name: Hardkernel ODROID-N2Plus (DT) [  \u002B0.000008] Call trace: [  \u002B0.000007]  dump_backtrace\u002B0x1ec/0x280 [  \u002B0.000013]  show_stack\u002B0x24/0x80 [  \u002B0.000008]  dump_stack_lvl\u002B0x98/0xd4 [  \u002B0.000011]  print_address_description.constprop.0\u002B0x80/0x520 [  \u002B0.000011]  print_report\u002B0x128/0x260 [  \u002B0.000007]  kasan_report\u002B0xb8/0xfc [  \u002B0.000008]  __asan_report_load8_noabort\u002B0x3c/0x50 [  \u002B0.000010]  __list_del_entry_valid\u002B0xe0/0x1a0 [  \u002B0.000009]  drm_atomic_private_obj_fini\u002B0x30/0x200 [drm] [  \u002B0.000172]  drm_bridge_detach\u002B0x94/0x260 [drm] [  \u002B0.000145]  drm_encoder_cleanup\u002B0xa4/0x290 [drm] [  \u002B0.000144]  drm_mode_config_cleanup\u002B0x118/0x740 [drm] [  \u002B0.000143]  drm_mode_config_init_release\u002B0x1c/0x2c [drm] [  \u002B0.000144]  drm_managed_release\u002B0x170/0x414 [drm] [  \u002B0.000142]  drm_dev_put.part.0\u002B0xc0/0x124 [drm] [  \u002B0.000143]  drm_dev_put\u002B0x20/0x30 [drm] [  \u002B0.000142]  meson_drv_unbind\u002B0x1d8/0x2ac [meson_drm] [  \u002B0.000028]  take_down_aggregate_device\u002B0xb0/0x160 [  \u002B0.000016]  component_del\u002B0x18c/0x360 [  \u002B0.000009]  meson_dw_hdmi_remove\u002B0x28/0x40 [meson_dw_hdmi] [  \u002B0.000015]  platform_remove\u002B0x64/0xb0 [  \u002B0.000009]  device_remove\u002B0xb8/0x154 [  \u002B0.000009]  device_release_driver_internal\u002B0x398/0x5b0 [  \u002B0.000009]  driver_detach\u002B0xac/0x1b0 [  \u002B0.000009]  bus_remove_driver\u002B0x158/0x29c [  \u002B0.000009]  driver_unregister\u002B0x70/0xb0 [  \u002B0.000008]  platform_driver_unregister\u002B0x20/0x2c [  \u002B0.000008]  meson_dw_hdmi_platform_driver_exit\u002B0x1c/0x30 [meson_dw_hdmi] [  \u002B0.000012]  __do_sys_delete_module\u002B0x288/0x400 [  \u002B0.000011]  __arm64_sys_delete_module\u002B0x5c/0x80 [  \u002B0.000009]  invoke_syscall\u002B0x74/0x260 [  \u002B0.000009]  el0_svc_common.constprop.0\u002B0xcc/0x260 [  \u002B0.000009]  do_el0_svc\u002B0x50/0x70 [  \u002B0.000007]  el0_svc\u002B0x68/0x1a0 [  \u002B0.000012]  el0t_64_sync_handler\u002B0x11c/0x150 [  \u002B0.000008]  el0t_64_sync\u002B0x18c/0x190  [  \u002B0.000018] Allocated by task 0: [  \u002B0.000007] (stack is not available)  [  \u002B0.000011] Freed by task 2695: [  \u002B0.000008]  kasan_save_stack\u002B0x2c/0x5c [  \u002B0.000011]  kasan_set_track\u002B0x2c/0x40 [  \u002B0.000008]  kasan_set_free_info\u002B0x28/0x50 [  \u002B0.000009]  ____kasan_slab_free\u002B0x128/0x1d4 [  \u002B0.000008]  __kasan_slab_free\u002B0x18/0x24 [  \u002B0.000007]  slab_free_freelist_hook\u002B0x108/0x230 [  \u002B0.000011]  kfree\u002B0x110/0x35c [  \u002B0.000008]  release_nodes\u002B0xf0/0x16c [  \u002B0.000009]  devres_release_group\u002B0x180/0x270 [  \u002B0.000008]  component_unbind\u002B0x128/0x1e0 [  \u002B0.000010]  component_unbind_all\u002B0x1b8/0x264 [  \u002B0.000009]  meson_drv_unbind\u002B0x1a0/0x2ac [meson_drm] [  \u002B0.000025]  take_down_aggregate_device\u002B0xb0/0x160 [  \u002B0.000009]  component_del\u002B0x18c/0x360 [  \u002B0.000009]  meson_dw_hdmi_remove\u002B0x28/0x40 [meson_dw_hdmi] [  \u002B0.000012]  platform_remove\u002B0x64/0xb0 [  \u002B0.000008]  device_remove\u002B0xb8/0x154 [  \u002B0.000009]  device_release_driver_internal\u002B0x398/0x5b0 [  \u002B0.000009]  driver_detach\u002B0xac/0x1b0 [  \u002B0.000009]  bus_remove_driver\u002B0x158/0x29c [  \u002B0.000008]  driver_unregister\u002B0x70/0xb0 [  \u002B0.000008]  platform_driver_unregister\u002B0x20/0x2c [  \u002B0.000008]  meson_dw_hdmi_platform_driver_exit\u002B0x1c/0x30 [meson_dw_hdmi] [  \u002B0.000011]  __do_sys_delete_module\u002B0x288/0x400 [  \u002B0.000010]  __arm64_sys_delete_module\u002B0x5c/0x80 [  \u002B0.000008]  invoke_syscall\u002B0x74/0x260 [  \u002B0.000008]  el0_svc_common.constprop.0\u002B0xcc/0x260 [  \u002B0.000008]  do_el0_svc\u002B0x50/0x70 [  \u002B0.000007]  el0_svc\u002B0x68/0x1a0 [  \u002B0.000009]  el0t_64_sync_handler\u002B0x11c/0x150 [  \u002B0.000009]  el0t_64_sync\u002B0x18c/0x190  [  \u002B0.000014] The buggy address belongs to the object at ffff000020c39000 ---truncated---",
  "published": "2025-09-18T14:15:36Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00163,
  "epssPercentile": 0.05515,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.0.3-1",
      "fix": "DEBIAN-CVE-2022-50378",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50378",
      "released": "2025-09-18T14:15:36Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.0.3-1",
      "fix": "DEBIAN-CVE-2022-50378",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50378",
      "released": "2025-09-18T14:15:36Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.0.3-1",
      "fix": "DEBIAN-CVE-2022-50378",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-50378",
      "released": "2025-09-18T14:15:36Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}