GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50115 (GCVE-0-2022-50115)

Vulnerability from cvelistv5 – Published: 2025-06-18 11:02 – Updated: 2026-05-11 19:13
VLAI
Title
ASoC: SOF: ipc3-topology: Prevent double freeing of ipc_control_data via load_bytes
Summary
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-topology: Prevent double freeing of ipc_control_data via load_bytes We have sanity checks for byte controls and if any of the fail the locally allocated scontrol->ipc_control_data is freed up, but not set to NULL. On a rollback path of the error the higher level code will also try to free the scontrol->ipc_control_data which will eventually going to lead to memory corruption as double freeing memory is not a good thing.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b5cee8feb1d482a9d07b677f4f2f9565bacda53e , < 8463986b54295e6b65ddf2b7c65627d01ce7643b (git)
Affected: b5cee8feb1d482a9d07b677f4f2f9565bacda53e , < c2eddfcafcffaf1b9245ea0dde9143bbfb47d5d1 (git)
Affected: b5cee8feb1d482a9d07b677f4f2f9565bacda53e , < d5bd47f3ca124058a8e87eae4508afeda2132611 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 5.18.18 , ≤ 5.18.* (semver)
Unaffected: 5.19.2 , ≤ 5.19.* (semver)
Unaffected: 6.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/sof/ipc3-topology.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8463986b54295e6b65ddf2b7c65627d01ce7643b",
              "status": "affected",
              "version": "b5cee8feb1d482a9d07b677f4f2f9565bacda53e",
              "versionType": "git"
            },
            {
              "lessThan": "c2eddfcafcffaf1b9245ea0dde9143bbfb47d5d1",
              "status": "affected",
              "version": "b5cee8feb1d482a9d07b677f4f2f9565bacda53e",
              "versionType": "git"
            },
            {
              "lessThan": "d5bd47f3ca124058a8e87eae4508afeda2132611",
              "status": "affected",
              "version": "b5cee8feb1d482a9d07b677f4f2f9565bacda53e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/sof/ipc3-topology.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.18",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.2",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc3-topology: Prevent double freeing of ipc_control_data via load_bytes\n\nWe have sanity checks for byte controls and if any of the fail the locally\nallocated scontrol-\u003eipc_control_data is freed up, but not set to NULL.\n\nOn a rollback path of the error the higher level code will also try to free\nthe scontrol-\u003eipc_control_data which will eventually going to lead to\nmemory corruption as double freeing memory is not a good thing."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:13:08.168Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8463986b54295e6b65ddf2b7c65627d01ce7643b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2eddfcafcffaf1b9245ea0dde9143bbfb47d5d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5bd47f3ca124058a8e87eae4508afeda2132611"
        }
      ],
      "title": "ASoC: SOF: ipc3-topology: Prevent double freeing of ipc_control_data via load_bytes",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50115",
    "datePublished": "2025-06-18T11:02:46.759Z",
    "dateReserved": "2025-06-18T10:57:27.415Z",
    "dateUpdated": "2026-05-11T19:13:08.168Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50115",
      "date": "2026-09-18",
      "epss": "0.00183",
      "percentile": "0.08171"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "sound/soc/sof/ipc3-topology.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "8463986b54295e6b65ddf2b7c65627d01ce7643b",
                    "status": "affected",
                    "version": "b5cee8feb1d482a9d07b677f4f2f9565bacda53e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c2eddfcafcffaf1b9245ea0dde9143bbfb47d5d1",
                    "status": "affected",
                    "version": "b5cee8feb1d482a9d07b677f4f2f9565bacda53e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d5bd47f3ca124058a8e87eae4508afeda2132611",
                    "status": "affected",
                    "version": "b5cee8feb1d482a9d07b677f4f2f9565bacda53e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "sound/soc/sof/ipc3-topology.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.18"
                  },
                  {
                    "lessThan": "5.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.18.*",
                    "status": "unaffected",
                    "version": "5.18.18",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.19.*",
                    "status": "unaffected",
                    "version": "5.19.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "28A3BD94-A9B1-461A-9325-1B7EF7D364B6",
                    "versionEndExcluding": "5.18.18",
                    "versionStartIncluding": "5.18",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A1A2A5A5-4598-4D7E-BA07-4660398D6C8F",
                    "versionEndExcluding": "5.19.2",
                    "versionStartIncluding": "5.19",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc3-topology: Prevent double freeing of ipc_control_data via load_bytes\n\nWe have sanity checks for byte controls and if any of the fail the locally\nallocated scontrol-\u003eipc_control_data is freed up, but not set to NULL.\n\nOn a rollback path of the error the higher level code will also try to free\nthe scontrol-\u003eipc_control_data which will eventually going to lead to\nmemory corruption as double freeing memory is not a good thing."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ASoC: SOF: ipc3-topology: Impide la doble liberaci\u00f3n de ipc_control_data mediante load_bytes. Se han realizado comprobaciones de seguridad para los controles de bytes y, si alguna falla, se libera el archivo scontrol-\u0026gt;ipc_control_data asignado localmente, pero no se establece en NULL. En una ruta de reversi\u00f3n del error, el c\u00f3digo de nivel superior tambi\u00e9n intentar\u00e1 liberar scontrol-\u0026gt;ipc_control_data, lo que eventualmente provocar\u00e1 corrupci\u00f3n de memoria, ya que la doble liberaci\u00f3n de memoria no es recomendable."
          }
        ],
        "id": "CVE-2022-50115",
        "lastModified": "2026-06-17T05:22:47.430",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-06-18T11:15:41.140",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8463986b54295e6b65ddf2b7c65627d01ce7643b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c2eddfcafcffaf1b9245ea0dde9143bbfb47d5d1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d5bd47f3ca124058a8e87eae4508afeda2132611"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-415"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T21:39:35+00:00",
      "cve": "CVE-2022-50115",
      "id": "CVE-2022-50115",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "286",
      "product_status:known_affected": "38",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ASoC: SOF: ipc3-topology: Prevent double freeing of ipc_control_data via load_bytes",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50115.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.