In the Linux kernel, the following vulnerability has been resolved:

ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()

There is an use-after-free reported by KASAN:

BUG: KASAN: use-after-free in acpi_ut_remove_reference+0x3b/0x82
Read of size 1 at addr ffff888112afc460 by task modprobe/2111
CPU: 0 PID: 2111 Comm: modprobe Not tainted 6.1.0-rc7-dirty
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
Call Trace:
<TASK>
kasan_report+0xae/0xe0
acpi_ut_remove_reference+0x3b/0x82
acpi_ut_copy_iobject_to_iobject+0x3be/0x3d5
acpi_ds_store_object_to_local+0x15d/0x3a0
acpi_ex_store+0x78d/0x7fd
acpi_ex_opcode_1A_1T_1R+0xbe4/0xf9b
acpi_ps_parse_aml+0x217/0x8d5
...
</TASK>

The root cause of the problem is that the acpi_operand_object
is freed when acpi_ut_walk_package_tree() fails in
acpi_ut_copy_ipackage_to_ipackage(), lead to repeated release in
acpi_ut_copy_iobject_to_iobject(). The problem was introduced
by "8aa5e56eeb61" commit, this commit is to fix memory leak in
acpi_ut_copy_iobject_to_iobject(), repeatedly adding remove
operation, lead to "acpi_operand_object" used after free.

Fix it by removing acpi_ut_remove_reference() in
acpi_ut_copy_ipackage_to_ipackage(). acpi_ut_copy_ipackage_to_ipackage()
is called to copy an internal package object into another internal
package object, when it fails, the memory of acpi_operand_object
should be freed by the caller.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00014.

Exploitation none

Automatable no

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
8aa5e56eeb61a099ea6519eb30ee399e1bc043ce affected
< 133462d35dae95edb944af86b986d4c9dec59bd1
8aa5e56eeb61a099ea6519eb30ee399e1bc043ce affected
< 02f237423c9c6a18e062de2d474f85d5659e4eb9
8aa5e56eeb61a099ea6519eb30ee399e1bc043ce affected
< c9125b643fc51b8e662f2f614096ceb45a0adbc3
8aa5e56eeb61a099ea6519eb30ee399e1bc043ce affected
< dfdde4d5138bc023897033a5ac653a84e94805be
8aa5e56eeb61a099ea6519eb30ee399e1bc043ce affected
< 02617006b5a46f2ea55ac61f5693c7afd7bf9276
8aa5e56eeb61a099ea6519eb30ee399e1bc043ce affected
< 6fde666278f91b85d71545a0ebbf41d8d7af8074
8aa5e56eeb61a099ea6519eb30ee399e1bc043ce affected
< f51b2235e4f320edc839c3e5cb0d1f8a6e8657c6
8aa5e56eeb61a099ea6519eb30ee399e1bc043ce affected
< 01f2c2052ea50fb9a8ce12e4e83aed0267934ef0
8aa5e56eeb61a099ea6519eb30ee399e1bc043ce affected
< 470188b09e92d83c5a997f25f0e8fb8cd2bc3469
b3e98f0c4f996cd53b80bad71f0d7e4a2cf3a4e8 affected
—
7af5504c102a378376101dbd160246b10a814dd0 affected
—
e29a15484d7ea949e49ae7fb7e576a575da824a6 affected
—
e2ab6731a36966d042a2d4dabd980496cd680f75 affected
—
Linux Linux affected
Version Status Constraints
3.17 affected
—
0 unaffected
< 3.17
4.9.337 unaffected
≤ 4.9.*
4.14.303 unaffected
≤ 4.14.*
4.19.270 unaffected
≤ 4.19.*
5.4.229 unaffected
≤ 5.4.*
5.10.163 unaffected
≤ 5.10.*
5.15.86 unaffected
≤ 5.15.*
6.0.16 unaffected
≤ 6.0.*
6.1.2 unaffected
≤ 6.1.*
6.2 unaffected
≤ *

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

No data.

Vendor Product Confidence Versions
Linux Linux Kernel — —

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/01f2c2052ea50fb9a8ce12e4e83aed0267934ef0 cve-icon cve-icon
https://git.kernel.org/stable/c/02617006b5a46f2ea55ac61f5693c7afd7bf9276 cve-icon cve-icon
https://git.kernel.org/stable/c/02f237423c9c6a18e062de2d474f85d5659e4eb9 cve-icon cve-icon
https://git.kernel.org/stable/c/133462d35dae95edb944af86b986d4c9dec59bd1 cve-icon cve-icon
https://git.kernel.org/stable/c/470188b09e92d83c5a997f25f0e8fb8cd2bc3469 cve-icon cve-icon
https://git.kernel.org/stable/c/6fde666278f91b85d71545a0ebbf41d8d7af8074 cve-icon cve-icon
https://git.kernel.org/stable/c/c9125b643fc51b8e662f2f614096ceb45a0adbc3 cve-icon cve-icon
https://git.kernel.org/stable/c/dfdde4d5138bc023897033a5ac653a84e94805be cve-icon cve-icon
https://git.kernel.org/stable/c/f51b2235e4f320edc839c3e5cb0d1f8a6e8657c6 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025100155-CVE-2022-50423-5a66@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-50423 cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-50423 cve-icon
History

Wed, 14 Jan 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 11 Dec 2025 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Thu, 02 Oct 2025 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Vendors & Products Linux
Linux linux Kernel

Thu, 02 Oct 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low

Wed, 01 Oct 2025 12:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() There is an use-after-free reported by KASAN: BUG: KASAN: use-after-free in acpi_ut_remove_reference+0x3b/0x82 Read of size 1 at addr ffff888112afc460 by task modprobe/2111 CPU: 0 PID: 2111 Comm: modprobe Not tainted 6.1.0-rc7-dirty Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), Call Trace: <TASK> kasan_report+0xae/0xe0 acpi_ut_remove_reference+0x3b/0x82 acpi_ut_copy_iobject_to_iobject+0x3be/0x3d5 acpi_ds_store_object_to_local+0x15d/0x3a0 acpi_ex_store+0x78d/0x7fd acpi_ex_opcode_1A_1T_1R+0xbe4/0xf9b acpi_ps_parse_aml+0x217/0x8d5 ... </TASK> The root cause of the problem is that the acpi_operand_object is freed when acpi_ut_walk_package_tree() fails in acpi_ut_copy_ipackage_to_ipackage(), lead to repeated release in acpi_ut_copy_iobject_to_iobject(). The problem was introduced by "8aa5e56eeb61" commit, this commit is to fix memory leak in acpi_ut_copy_iobject_to_iobject(), repeatedly adding remove operation, lead to "acpi_operand_object" used after free. Fix it by removing acpi_ut_remove_reference() in acpi_ut_copy_ipackage_to_ipackage(). acpi_ut_copy_ipackage_to_ipackage() is called to copy an internal package object into another internal package object, when it fails, the memory of acpi_operand_object should be freed by the caller.
Title ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-01-14T17:42:46.653Z

Reserved: 2025-09-17T14:53:07.004Z

Link: CVE-2022-50423

cve-icon Vulnrichment

Updated: 2026-01-14T17:39:53.133Z

cve-icon NVD

Status : Modified

Published: 2025-10-01T12:15:33.683

Modified: 2026-01-14T18:16:27.960

Link: CVE-2022-50423

cve-icon Redhat

Severity : Low

Publid Date: 2025-10-01T00:00:00Z

Links: CVE-2022-50423 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2025-10-02T08:39:44Z

Weaknesses