CVE-2022-50305
Severity CVSS v4.0:
Pending analysis
Type:
CWE-416
Use After Free
Publication date:
15/09/2025
Last modified:
04/12/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
ASoC: sof_es8336: fix possible use-after-free in sof_es8336_remove()<br />
<br />
sof_es8336_remove() calls cancel_delayed_work(). However, that<br />
function does not wait until the work function finishes. This<br />
means that the callback function may still be running after<br />
the driver&#39;s remove function has finished, which would result<br />
in a use-after-free.<br />
<br />
Fix by calling cancel_delayed_work_sync(), which ensures that<br />
the work is properly cancelled, no longer running, and unable<br />
to re-schedule itself.
Impact
Base Score 3.x
7.80
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.0.11 (including) | 6.0.16 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.1.1 (including) | 6.1.2 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.1:-:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page