CVE-2022-50454

HighCVSS 7.8/10Last modified Aug 4, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()

nouveau_bo_init() is backed by ttm_bo_init() and ferries its return code back to the caller. On failures, ttm will call nouveau_bo_del_ttm() and free the memory.Thus, when nouveau_bo_init() returns an error, the gem object has already been released. Then the call to nouveau_bo_ref() will use the freed "nvbo->bo" and lead to a use-after-free bug.

We should delete the call to nouveau_bo_ref() to avoid the use-after-free.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
LinuxLinux>= 019cbd4a4feb3aa3a917d78e7110e3011bbff6d5, < 56ee9577915dc06f55309901012a9ef68dbdb5a8; >= 019cbd4a4feb3aa3a917d78e7110e3011bbff6d5, < 5d6093c49c098d86c7b136aba9922df44aeb6944; >= 019cbd4a4feb3aa3a917d78e7110e3011bbff6d5, < 861f085f81fd569b02cc2c11165a9e6cca144424; >= 019cbd4a4feb3aa3a917d78e7110e3011bbff6d5, < 3aeda2fe6517cc52663d4ce3588dd43f0d4124a7; >= 019cbd4a4feb3aa3a917d78e7110e3011bbff6d5, < 7d80473e9f12548ac05b36af4fb9ce80f2f73509; >= 019cbd4a4feb3aa3a917d78e7110e3011bbff6d5, < 540dfd188ea2940582841c1c220bd035a7db0e51
LinuxLinux5.4

References

Timeline

Published
Oct 1, 2025
Last modified
Aug 4, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-504565.5In the Linux kernel, the following vulnerability has been resolved: btrfs: fix resolving backrefs for inline extent followed by prealloc ICVE-2022-504575.5In the Linux kernel, the following vulnerability has been resolved: mtd: core: Fix refcount error in del_mtd_device() del_mtd_device() wilCVE-2022-504585.5In the Linux kernel, the following vulnerability has been resolved: clk: tegra: Fix refcount leak in tegra210_clock_init of_find_matching_CVE-2022-504595.5In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername() CVE-2022-504605.5In the Linux kernel, the following vulnerability has been resolved: cifs: Fix xid leak in cifs_flock() If not flock, before return -ENOLCKCVE-2022-504615.5In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw: Fix PM runtime leakage in am65_cpsw_nuss_CVE-2022-504625.5In the Linux kernel, the following vulnerability has been resolved: MIPS: vpe-mt: fix possible memory leak while module exiting Afer commiCVE-2022-504635.5In the Linux kernel, the following vulnerability has been resolved: powerpc/52xx: Fix a resource leak in an error handling path The error CVE-2022-504645.5In the Linux kernel, the following vulnerability has been resolved: mt76: mt7915: Fix PCI device refcount leak in mt7915_pci_init_hif2() ACVE-2022-504655.5In the Linux kernel, the following vulnerability has been resolved: ext4: fix leaking uninitialized memory in fast-commit journal When spaCVE-2022-504665.5In the Linux kernel, the following vulnerability has been resolved: fs/binfmt_elf: Fix memory leak in load_elf_binary() There is a memory CVE-2022-504675.5In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix null ndlp ptr dereference in abnormal exit path for GFT
CVE-2022-50454: High severity, CVSS 7.8 | Vulnix