CVE-2022-49524

media: pci: cx23885: Fix the error handling in cx23885_initdev()

HIGH

7.8

CVSS Score

Published: February 26, 2025 at 02:13 AM UTC

Updated: June 17, 2026 at 05:18 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: media: pci: cx23885: Fix the error handling in cx23885_initdev() When the driver fails to call the dma_set_mask(), the driver will get the following splat: [ 55.853884] BUG: KASAN: use-after-free in __process_removed_driver+0x3c/0x240 [ 55.854486] Read of size 8 at addr ffff88810de60408 by task modprobe/590 [ 55.856822] Call Trace: [ 55.860327] __process_removed_driver+0x3c/0x240 [ 55.861347] bus_for_each_dev+0x102/0x160 [ 55.861681] i2c_del_driver+0x2f/0x50 This is because the driver has initialized the i2c related resources in cx23885_dev_setup() but not released them in error handling, fix this bug by modifying the error path that jumps after failing to call the dma_set_mask().

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

v < 4.14.2834.15 ≤ v < 4.19.2474.20 ≤ v < 5.4.1984.8 ≤ v < 4.14.2834.8 ≤ v < 4.19.2474.8 ≤ v < 5.10.1214.8 ≤ v < 5.15.464.8 ≤ v < 5.17.144.8 ≤ v < 5.18.34.8 ≤ v < 5.194.8 ≤ v < 5.4.1985.11 ≤ v < 5.15.465.16 ≤ v < 5.17.145.18 ≤ v < 5.18.35.5 ≤ v < 5.10.1212bc46b3ad3c15165f91459b07ff86824786831944.8

Vendor states this is fixed in 453514a874c78df1e7804e6e3aaa60c8d8deb6a8 (fixed)

Vendor states this is fixed in 6041d1a0365baa729b6adfb6ed5386d9388018db (fixed)

Vendor states this is fixed in 7b9978e1c94e569d65a0e7e719abb9340f5db4a0 (fixed)

Vendor states this is fixed in 86bd6a579c6c60547706cabf299cd2c9feab3332 (fixed)

Vendor states this is fixed in 98106f100f50c487469903b9cf6d966785fc9cc3 (fixed)

Vendor states this is fixed in ca17e7a532d1a55466cc007b3f4d319541a27493 (fixed)

Vendor states this is fixed in e8123311cf06d7dae71e8c5fe78e0510d20cd30b (fixed)

Vendor states this is fixed in fa636e9ee4442215cd9a2e079cd5a8e1fe0cb8ba (fixed)

Vendor states this is fixed in 4.14.283 (unaffected)

Vendor states this is fixed in 4.19.247 (unaffected)

Vendor states this is fixed in 4.8 (unaffected)

Vendor states this is fixed in 5.10.121 (unaffected)

Vendor states this is fixed in 5.15.46 (unaffected)

Vendor states this is fixed in 5.17.14 (unaffected)

Vendor states this is fixed in 5.18.3 (unaffected)

Vendor states this is fixed in 5.19 (unaffected)

Vendor states this is fixed in 5.4.198 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references