GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50745 (GCVE-0-2022-50745)

Vulnerability from cvelistv5 – Published: 2025-12-24 13:05 – Updated: 2026-08-05 08:59
VLAI
Title
staging: media: tegra-video: fix device_node use after free
Summary
In the Linux kernel, the following vulnerability has been resolved: staging: media: tegra-video: fix device_node use after free At probe time this code path is followed: * tegra_csi_init * tegra_csi_channels_alloc * for_each_child_of_node(node, channel) -- iterates over channels * automatically gets 'channel' * tegra_csi_channel_alloc() * saves into chan->of_node a pointer to the channel OF node * automatically gets and puts 'channel' * now the node saved in chan->of_node has refcount 0, can disappear * tegra_csi_channels_init * iterates over channels * tegra_csi_channel_init -- uses chan->of_node After that, chan->of_node keeps storing the node until the device is removed. of_node_get() the node and of_node_put() it during teardown to avoid any risk.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1ebaeb09830f36c1111b72a95420814225bd761c , < 5451efb2ca30f3c42b9efb8327ce35b62870dbd3 (git)
Affected: 1ebaeb09830f36c1111b72a95420814225bd761c , < ce50c612458091d926ccb05d7db11d9f93532db2 (git)
Affected: 1ebaeb09830f36c1111b72a95420814225bd761c , < 6512c9498fcb97e7c760e3ef86b2272f2c0f765f (git)
Affected: 1ebaeb09830f36c1111b72a95420814225bd761c , < 0fd003d3c708c80350a815eaf37b8e1114b976cf (git)
Affected: 1ebaeb09830f36c1111b72a95420814225bd761c , < c4d344163c3a7f90712525f931a6c016bbb35e18 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 5.10.163 , ≤ 5.10.* (semver)
Unaffected: 5.15.87 , ≤ 5.15.* (semver)
Unaffected: 6.0.18 , ≤ 6.0.* (semver)
Unaffected: 6.1.4 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/media/tegra-video/csi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5451efb2ca30f3c42b9efb8327ce35b62870dbd3",
              "status": "affected",
              "version": "1ebaeb09830f36c1111b72a95420814225bd761c",
              "versionType": "git"
            },
            {
              "lessThan": "ce50c612458091d926ccb05d7db11d9f93532db2",
              "status": "affected",
              "version": "1ebaeb09830f36c1111b72a95420814225bd761c",
              "versionType": "git"
            },
            {
              "lessThan": "6512c9498fcb97e7c760e3ef86b2272f2c0f765f",
              "status": "affected",
              "version": "1ebaeb09830f36c1111b72a95420814225bd761c",
              "versionType": "git"
            },
            {
              "lessThan": "0fd003d3c708c80350a815eaf37b8e1114b976cf",
              "status": "affected",
              "version": "1ebaeb09830f36c1111b72a95420814225bd761c",
              "versionType": "git"
            },
            {
              "lessThan": "c4d344163c3a7f90712525f931a6c016bbb35e18",
              "status": "affected",
              "version": "1ebaeb09830f36c1111b72a95420814225bd761c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/media/tegra-video/csi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.163",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.87",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.18",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.4",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: media: tegra-video: fix device_node use after free\n\nAt probe time this code path is followed:\n\n * tegra_csi_init\n   * tegra_csi_channels_alloc\n     * for_each_child_of_node(node, channel) -- iterates over channels\n       * automatically gets \u0027channel\u0027\n         * tegra_csi_channel_alloc()\n           * saves into chan-\u003eof_node a pointer to the channel OF node\n       * automatically gets and puts \u0027channel\u0027\n       * now the node saved in chan-\u003eof_node has refcount 0, can disappear\n   * tegra_csi_channels_init\n     * iterates over channels\n       * tegra_csi_channel_init -- uses chan-\u003eof_node\n\nAfter that, chan-\u003eof_node keeps storing the node until the device is\nremoved.\n\nof_node_get() the node and of_node_put() it during teardown to avoid any\nrisk."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The defect is reached only on the local Tegra CSI platform probe path (tegra_csi_probe \u2192 host1x_client_register \u2192 tegra_csi_init \u2192 tegra_csi_channels_alloc/init) when parsing DT channel children; it is not reachable via network or adjacent-link packet processing.\nAC:L - for_each_child_of_node drops its temporary reference after each channel allocation, and the missing of_node_get leaves a long-lived dangling pointer deterministically on every non-TPG probe with channel nodes; on OF_DYNAMIC/overlay Tegra camera setups the node can be freed while still referenced with no attacker-uncontrollable race.\nPR:L - The buggy path runs automatically during ordinary boot-time/driver probe on affected Tegra210 VIDEO_TEGRA DT configurations with no capability gate, and per the higher-severity reading used for similar probe-time of_node UAF bugs a basic local user is scored rather than requiring init-namespace root.\nUI:N - Channel allocation and tegra_csi_channel_init run as part of normal host1x/video device initialization; no separate victim action such as mounting a filesystem or opening a device is required.\nS:U - The corrupted object is a kernel device_node used by the tegra-video CSI subdev within the host kernel\u2019s security authority; this is ordinary kernel memory-safety impact, not a VM escape or IOMMU/sandbox boundary cross.\nC:H - Holding chan-\u003eof_node (and subdev-\u003efwnode derived from it) after the iterator\u2019s of_node_put without of_node_get is a use-after-free on the device_node; per UAF guidance that enables heap reuse and arbitrary kernel disclosure.\nI:H - The same device_node UAF is a heap-spray target whose freed object fields can be overwritten, converting the dangling OF/fwnode reference into an arbitrary-write and control-flow hijack primitive.\nA:H - Use of the dangling of_node (e.g. full_name / fwnode after free, or later teardown) causes kernel oops/panic, and UAFs are scored Availability High even when not fully exploited."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:59:34.782Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5451efb2ca30f3c42b9efb8327ce35b62870dbd3"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce50c612458091d926ccb05d7db11d9f93532db2"
        },
        {
          "url": "https://git.kernel.org/stable/c/6512c9498fcb97e7c760e3ef86b2272f2c0f765f"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fd003d3c708c80350a815eaf37b8e1114b976cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4d344163c3a7f90712525f931a6c016bbb35e18"
        }
      ],
      "title": "staging: media: tegra-video: fix device_node use after free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50745",
    "datePublished": "2025-12-24T13:05:41.858Z",
    "dateReserved": "2025-12-24T13:02:21.543Z",
    "dateUpdated": "2026-08-05T08:59:34.782Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50745",
      "date": "2026-09-19",
      "epss": "0.00189",
      "percentile": "0.08764"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/staging/media/tegra-video/csi.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5451efb2ca30f3c42b9efb8327ce35b62870dbd3",
                    "status": "affected",
                    "version": "1ebaeb09830f36c1111b72a95420814225bd761c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ce50c612458091d926ccb05d7db11d9f93532db2",
                    "status": "affected",
                    "version": "1ebaeb09830f36c1111b72a95420814225bd761c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6512c9498fcb97e7c760e3ef86b2272f2c0f765f",
                    "status": "affected",
                    "version": "1ebaeb09830f36c1111b72a95420814225bd761c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0fd003d3c708c80350a815eaf37b8e1114b976cf",
                    "status": "affected",
                    "version": "1ebaeb09830f36c1111b72a95420814225bd761c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c4d344163c3a7f90712525f931a6c016bbb35e18",
                    "status": "affected",
                    "version": "1ebaeb09830f36c1111b72a95420814225bd761c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/staging/media/tegra-video/csi.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.10"
                  },
                  {
                    "lessThan": "5.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.163",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.87",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.0.*",
                    "status": "unaffected",
                    "version": "6.0.18",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: media: tegra-video: fix device_node use after free\n\nAt probe time this code path is followed:\n\n * tegra_csi_init\n   * tegra_csi_channels_alloc\n     * for_each_child_of_node(node, channel) -- iterates over channels\n       * automatically gets \u0027channel\u0027\n         * tegra_csi_channel_alloc()\n           * saves into chan-\u003eof_node a pointer to the channel OF node\n       * automatically gets and puts \u0027channel\u0027\n       * now the node saved in chan-\u003eof_node has refcount 0, can disappear\n   * tegra_csi_channels_init\n     * iterates over channels\n       * tegra_csi_channel_init -- uses chan-\u003eof_node\n\nAfter that, chan-\u003eof_node keeps storing the node until the device is\nremoved.\n\nof_node_get() the node and of_node_put() it during teardown to avoid any\nrisk."
          }
        ],
        "id": "CVE-2022-50745",
        "lastModified": "2026-08-04T10:18:22.743",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-24T13:16:01.210",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0fd003d3c708c80350a815eaf37b8e1114b976cf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5451efb2ca30f3c42b9efb8327ce35b62870dbd3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6512c9498fcb97e7c760e3ef86b2272f2c0f765f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c4d344163c3a7f90712525f931a6c016bbb35e18"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ce50c612458091d926ccb05d7db11d9f93532db2"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-20T12:52:48+00:00",
      "cve": "CVE-2022-50745",
      "id": "CVE-2022-50745",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Use-after-free in tegra-video driver can lead to privilege escalation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50745.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.