PT-2025-40106 · Linux+1 · Linux Kernel+1

Published 2022-09-21 · Updated 2025-10-01 · CVE-2022-50421

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel’s rpmsg subsystem related to the destruction of the default endpoint. Specifically, the rpmsg dev remove() function in rpmsg core is responsible for releasing the default endpoint, but a double destroy issue can occur in rpmsg chrdev eptdev destroy(). This results in a use-after-free condition, indicated by a warning in ept->refcount. The issue is reproducible when stopping remoteproc before closing the /dev/rpmsgX device. The vulnerable function is rpmsg dev remove().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2026-03840

CVE-2022-50421

RHSA-2025:6966

RHSA-2025_6966

Affected Products

Linux Kernel

Red Hat

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50421.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-50421 · Vendor Advisory
• https://git.kernel.org/stable/c/ef828a39d6a7028836eaf37df3ad568c8c2dd6f9 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-50421 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-50421 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-50421 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03840 · Security Note
• https://git.kernel.org/stable/c/3f20ef7a845c2c8d7ec82ecffa20d95cab5ecfeb · Patch
• https://cve.org/CVERecord?id=CVE-2022-50421 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-50421 · Security Note
• https://git.kernel.org/stable/c/467233a4ac29b215d492843d067a9f091e6bf0c5 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-50421 · Vendor Advisory
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.17 · Note
• https://t.me/cveNotify/137048 · Telegram Post
• https://twitter.com/CVEnew/status/1973396733787848957 · Twitter Post