PT-2025-40139 · Linux+2 · Linux Kernel+2

Published 2022-07-07 · Updated 2025-10-23 · CVE-2022-50454

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue was identified in the nouveau gem prime import sg table() function within the Nouveau driver. The issue occurs because nouveau bo init() can return an error after the gem object has already been released, leading to a use-after-free when nouveau bo ref() is called with freed memory (nvbo->bo). The root cause is that nouveau bo init() relies on ttm bo init() and forwards its return code. On failure, ttm bo init() calls nouveau bo del ttm() to free the memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2026-01631

CVE-2022-50454

SUSE-SU-2025:03613-1

SUSE-SU-2025:03615-1

SUSE-SU-2025:03626-1

SUSE-SU-2025:03628-1

SUSE-SU-2025:3716-1

SUSE-SU-2025:3761-1

Affected Products

Linux Kernel

Nouveau

Suse

References · 880

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50454.json · Exploit
• https://git.kernel.org/stable/c/5d6093c49c098d86c7b136aba9922df44aeb6944 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:03613-1 · Vendor Advisory
• https://git.kernel.org/stable/c/7d80473e9f12548ac05b36af4fb9ce80f2f73509 · Patch
• https://git.kernel.org/stable/c/861f085f81fd569b02cc2c11165a9e6cca144424 · Patch
• https://cve.org/CVERecord?id=CVE-2022-50454 · Security Note
• https://bdu.fstec.ru/vul/2026-01631 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-50454 · Security Note
• https://ubuntu.com/security/CVE-2022-50454 · Vendor Advisory
• https://git.kernel.org/stable/c/56ee9577915dc06f55309901012a9ef68dbdb5a8 · Patch
• https://git.kernel.org/stable/c/3aeda2fe6517cc52663d4ce3588dd43f0d4124a7 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:3761-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-50454 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-50454 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03628-1 · Vendor Advisory