CVE-2022-50437

drm/msm/hdmi: fix memory corruption with too many bridges

HIGH

7.8

CVSS Score

Published: October 1, 2025 at 11:42 AM UTC

Updated: August 5, 2026 at 09:24 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: drm/msm/hdmi: fix memory corruption with too many bridges Add the missing sanity check on the bridge counter to avoid corrupting data beyond the fixed-sized bridge array in case there are ever more than eight bridges. Patchwork: https://patchwork.freedesktop.org/patch/502670/

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

3.12 ≤ v < 4.14.2983.12 ≤ v < 4.19.2643.12 ≤ v < 4.9.3323.12 ≤ v < 5.10.1533.12 ≤ v < 5.15.773.12 ≤ v < 5.4.2233.12 ≤ v < 6.0.73.12 ≤ v < 6.14.10 ≤ v < 4.14.2984.15 ≤ v < 4.19.2644.20 ≤ v < 5.4.2235.11 ≤ v < 5.15.775.16 ≤ v < 6.0.75.5 ≤ v < 5.10.1536.1 rc1 6.1 rc2a3376e3ec81c5dd0622cbc187db76d2824d31c1c

Vendor states this is fixed in 08c7375fa27a8ceee028868e03ffb3a0db919d44 (fixed)

Vendor states this is fixed in 3c43f3ec731c233eb84b66199ee76dbf3ec6ecae (fixed)

Vendor states this is fixed in 4c1294da6aed1f16d47a417dcfe6602833c3c95c (fixed)

Vendor states this is fixed in 9efb45b45ff6254bfd1f1997a06725cb3fc998a5 (fixed)

Vendor states this is fixed in a9c1a6991a9b5aa6d0f2cbc9b8c3bf6c4d094dfa (fixed)

Vendor states this is fixed in b48949ab451eaf1e2c04c272c8a9a96a2b56546f (fixed)

Vendor states this is fixed in e8f916b84e4b028ecad6c6472eaad543cc7df806 (fixed)

Vendor states this is fixed in ed7f1ff87a4afea1bc220d2ff00a7ce8e61f0b53 (fixed)

Vendor states this is fixed in 3.12 (unaffected)

Vendor states this is fixed in 4.14.298 (unaffected)

Vendor states this is fixed in 4.19.264 (unaffected)

Vendor states this is fixed in 4.9.332 (unaffected)