In the Linux kernel, the following vulnerability has been resolved:

media: si470x: Fix use-after-free in si470x_int_in_callback()

syzbot reported use-after-free in si470x_int_in_callback() [1]. This
indicates that urb->context, which contains struct si470x_device
object, is freed when si470x_int_in_callback() is called.

The cause of this issue is that si470x_int_in_callback() is called for
freed urb.

si470x_usb_driver_probe() calls si470x_start_usb(), which then calls
usb_submit_urb() and si470x_start(). If si470x_start_usb() fails,
si470x_usb_driver_probe() doesn't kill urb, but it just frees struct
si470x_device object, as depicted below:

si470x_usb_driver_probe()
...
si470x_start_usb()
...
usb_submit_urb()
retval = si470x_start()
return retval
if (retval < 0)
free struct si470x_device object, but don't kill urb

This patch fixes this issue by killing urb when si470x_start_usb()
fails and urb is submitted. If si470x_start_usb() fails and urb is
not submitted, i.e. submitting usb fails, it just frees struct
si470x_device object.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00014.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
779471110c6f0f7f7c223fc696170ec750ac3531 affected
< 146bd005ebb01ae190c22af050cb98623958c373
779471110c6f0f7f7c223fc696170ec750ac3531 affected
< 8c6151b8e8dd2d98ad2cd725d26d1e103d989891
779471110c6f0f7f7c223fc696170ec750ac3531 affected
< 52f54fe78cca24850a30865037250f63eb3d5bf7
779471110c6f0f7f7c223fc696170ec750ac3531 affected
< 0ca298d548461d29615f9a2b1309e8dcf4a352c6
779471110c6f0f7f7c223fc696170ec750ac3531 affected
< 1c6447d0fc68650e51586dde79b5090d9d77f13a
779471110c6f0f7f7c223fc696170ec750ac3531 affected
< 6c8aee0c8fcc6dda94315f7908e8fa9bc75abe75
779471110c6f0f7f7c223fc696170ec750ac3531 affected
< 63648a7bd1a7599bcc2040a6d1792363ae4c2e1b
779471110c6f0f7f7c223fc696170ec750ac3531 affected
< 92b0888398e4ba51d93b618a6506781f4e3879c9
779471110c6f0f7f7c223fc696170ec750ac3531 affected
< 7d21e0b1b41b21d628bf2afce777727bd4479aa5
Linux Linux affected
Version Status Constraints
3.6 affected
—
0 unaffected
< 3.6
4.9.337 unaffected
≤ 4.9.*
4.14.303 unaffected
≤ 4.14.*
4.19.270 unaffected
≤ 4.19.*
5.4.229 unaffected
≤ 5.4.*
5.10.163 unaffected
≤ 5.10.*
5.15.86 unaffected
≤ 5.15.*
6.0.16 unaffected
≤ 6.0.*
6.1.2 unaffected
≤ 6.1.*
6.2 unaffected
≤ *

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

No data.

Vendor Product Confidence Versions
Linux Linux Kernel — —

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0ca298d548461d29615f9a2b1309e8dcf4a352c6 cve-icon cve-icon
https://git.kernel.org/stable/c/146bd005ebb01ae190c22af050cb98623958c373 cve-icon cve-icon
https://git.kernel.org/stable/c/1c6447d0fc68650e51586dde79b5090d9d77f13a cve-icon cve-icon
https://git.kernel.org/stable/c/52f54fe78cca24850a30865037250f63eb3d5bf7 cve-icon cve-icon
https://git.kernel.org/stable/c/63648a7bd1a7599bcc2040a6d1792363ae4c2e1b cve-icon cve-icon
https://git.kernel.org/stable/c/6c8aee0c8fcc6dda94315f7908e8fa9bc75abe75 cve-icon cve-icon
https://git.kernel.org/stable/c/7d21e0b1b41b21d628bf2afce777727bd4479aa5 cve-icon cve-icon
https://git.kernel.org/stable/c/8c6151b8e8dd2d98ad2cd725d26d1e103d989891 cve-icon cve-icon
https://git.kernel.org/stable/c/92b0888398e4ba51d93b618a6506781f4e3879c9 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025100756-CVE-2022-50542-e0eb@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-50542 cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-50542 cve-icon
History

Wed, 04 Feb 2026 19:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Tue, 23 Dec 2025 13:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Wed, 08 Oct 2025 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Vendors & Products Linux
Linux linux Kernel

Wed, 08 Oct 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Tue, 07 Oct 2025 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: media: si470x: Fix use-after-free in si470x_int_in_callback() syzbot reported use-after-free in si470x_int_in_callback() [1]. This indicates that urb->context, which contains struct si470x_device object, is freed when si470x_int_in_callback() is called. The cause of this issue is that si470x_int_in_callback() is called for freed urb. si470x_usb_driver_probe() calls si470x_start_usb(), which then calls usb_submit_urb() and si470x_start(). If si470x_start_usb() fails, si470x_usb_driver_probe() doesn't kill urb, but it just frees struct si470x_device object, as depicted below: si470x_usb_driver_probe() ... si470x_start_usb() ... usb_submit_urb() retval = si470x_start() return retval if (retval < 0) free struct si470x_device object, but don't kill urb This patch fixes this issue by killing urb when si470x_start_usb() fails and urb is submitted. If si470x_start_usb() fails and urb is not submitted, i.e. submitting usb fails, it just frees struct si470x_device object.
Title media: si470x: Fix use-after-free in si470x_int_in_callback()
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-12-23T13:29:50.736Z

Reserved: 2025-10-07T15:15:38.667Z

Link: CVE-2022-50542

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2025-10-07T16:15:38.557

Modified: 2026-02-26T23:17:03.400

Link: CVE-2022-50542

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-10-07T00:00:00Z

Links: CVE-2022-50542 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2025-10-08T13:36:31Z

Weaknesses