Loading vulnerability…
Use-after-free race condition in Linux kernel DVB CA EN50221
CVE-2022-45919 is a race-condition vulnerability in the Linux kernel media subsystem's DVB CA EN50221 interface, affecting kernel versions through 6.0.10. Missing wait_event synchronization allows a use-after-free in dvb_ca_en50221_release() when a DVB device is disconnected after being opened. A local, low-privileged attacker may exploit the flaw to crash the system or potentially escalate privileges.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause a kernel crash and system-wide denial of service. Potential privilege escalation could compromise system confidentiality and integrity. Exploitation has high attack complexity because it depends on racing device disconnection with operations on an opened DVB device.
If you can’t patch tonight, do this now.
Blacklist the dvb-core kernel module to prevent the vulnerable code from loading when DVB functionality is not required. This disables functionality dependent on that module and is a temporary alternative to installing a fixed kernel.
Patch, then assume compromise.
Install the vendor-supported kernel update containing the fix and reboot into the updated kernel. Fixed Red Hat builds include 4.18.0-513.9.1.el8_9 for standard RHEL 8 kernels (RHSA-2023:7549), 4.18.0-513.9.1.rt7.311.el8_9 for RHEL 8 real-time kernels (RHSA-2023:7548), 4.18.0-372.80.1.el8_6 for RHEL 8.6 EUS (RHSA-2023:7398), and 4.18.0-477.36.1.el8_8 for RHEL 8.8 EUS (RHSA-2023:7539). Fedora included the fix in its 6.3.7 stable kernel updates. For applicable Rocky Linux 8.10 CIQ FIPS packages, apply CIQ advisory ciqsa-2026_1663; for CentOS 8.5 TuxCare packages, apply CLSA-2023-1695716575.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.