Loading vulnerability…
Use-After-Free in Linux Kernel DVB Device Unregistration
CVE-2022-50274 is a use-after-free vulnerability in the Linux kernel DVB device subsystem. The cleanup path in dvb_unregister_device() could deallocate a dvb_device while pointers retained in file private data still referenced that object. The fix adds reference counting to struct dvb_device and defers deallocation until no references remain.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A stale file-private-data pointer can reference a freed dvb_device object, resulting in a use-after-free condition. The available information does not specify the resulting confidentiality, integrity, availability, or code-execution impact.
If you can’t patch tonight, do this now.
Where immediate kernel updating is not possible, reduce exposure by disabling or removing unused DVB hardware and drivers and restricting untrusted local users' access to DVB device interfaces. These measures do not replace installation of a fixed kernel.
Patch, then assume compromise.
Apply a Linux kernel update containing the DVB device reference-counting fix, which delays dvb_device deallocation until outstanding references have been released. For affected Red Hat Enterprise Linux 8.6 channels, the referenced kernel update is version 4.18.0-372.80.1.el8_6; reboot after installation for the updated kernel to take effect.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.