CVE-2022-50087 (GCVE-0-2022-50087)

Vulnerability from cvelistv5 – Published: 2025-06-18 11:02 – Updated: 2026-08-05 08:57
VLAI
Title
firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails
Summary
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails When scpi probe fails, at any point, we need to ensure that the scpi_info is not set and will remain NULL until the probe succeeds. If it is not taken care, then it could result use-after-free as the value is exported via get_scpi_ops() and could refer to a memory allocated via devm_kzalloc() but freed when the probe fails.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-10 20:41 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa , < 5aa558232edc30468d1f35108826dd5b3ffe978f (git)
Affected: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa , < 18048cba444a7c41dbf42c180d6b46606fc24c51 (git)
Affected: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa , < 08272646cd7c310642c39b7f54348fddd7987643 (git)
Affected: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa , < 0c29e149b6bb498778ed8a1c9597b51acfba7856 (git)
Affected: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa , < 87c4896d5dd7fd9927c814cf3c6289f41de3b562 (git)
Affected: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa , < 4f2d7b46d6b53c07f44a4f8f8f4438888f0e9e87 (git)
Affected: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa , < 689640efc0a2c4e07e6f88affe6d42cd40cc3f85 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.4
Unaffected: 0 , < 4.4 (semver)
Unaffected: 4.19.256 , ≤ 4.19.* (semver)
Unaffected: 5.4.211 , ≤ 5.4.* (semver)
Unaffected: 5.10.137 , ≤ 5.10.* (semver)
Unaffected: 5.15.61 , ≤ 5.15.* (semver)
Unaffected: 5.18.18 , ≤ 5.18.* (semver)
Unaffected: 5.19.2 , ≤ 5.19.* (semver)
Unaffected: 6.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-50087",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:41:34.847637Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:13.909Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/arm_scpi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5aa558232edc30468d1f35108826dd5b3ffe978f",
              "status": "affected",
              "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
              "versionType": "git"
            },
            {
              "lessThan": "18048cba444a7c41dbf42c180d6b46606fc24c51",
              "status": "affected",
              "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
              "versionType": "git"
            },
            {
              "lessThan": "08272646cd7c310642c39b7f54348fddd7987643",
              "status": "affected",
              "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
              "versionType": "git"
            },
            {
              "lessThan": "0c29e149b6bb498778ed8a1c9597b51acfba7856",
              "status": "affected",
              "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
              "versionType": "git"
            },
            {
              "lessThan": "87c4896d5dd7fd9927c814cf3c6289f41de3b562",
              "status": "affected",
              "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
              "versionType": "git"
            },
            {
              "lessThan": "4f2d7b46d6b53c07f44a4f8f8f4438888f0e9e87",
              "status": "affected",
              "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
              "versionType": "git"
            },
            {
              "lessThan": "689640efc0a2c4e07e6f88affe6d42cd40cc3f85",
              "status": "affected",
              "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/arm_scpi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.4"
            },
            {
              "lessThan": "4.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.256",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.137",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.256",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.211",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.137",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.61",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.18",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.2",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails\n\nWhen scpi probe fails, at any point, we need to ensure that the scpi_info\nis not set and will remain NULL until the probe succeeds. If it is not\ntaken care, then it could result use-after-free as the value is exported\nvia get_scpi_ops() and could refer to a memory allocated via devm_kzalloc()\nbut freed when the probe fails."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in the ARM SCPI platform firmware driver (mailbox/shared-memory to the on-SoC SCP), reached during local driver probe and consumer deferred probes (scpi-hwmon/clk/cpufreq/pm-domain), not via network or adjacent protocols.\nAC:L - Any probe failure after early assignment of global scpi_info (including common -EPROBE_DEFER when the mailbox is not ready, or SCP firmware/capability failure) deterministically leaves a dangling pointer that get_scpi_ops() consumers then use; the attacker does not need a hard-to-influence race.\nPR:L - The UAF is hit from in-kernel deferred probe of SCPI consumers without CAP_SYS_ADMIN/sysfs bind, so a normal local unprivileged user context on an affected ARM SCPI system is sufficient for the highest-severity exploitation model (heap spray against the freed scpi_drvinfo).\nUI:N - No victim action is required; probe failure and subsequent get_scpi_ops() use occur automatically during boot/deferred probing.\nS:U - Impact remains within the kernel\u2019s security authority (local privilege escalation/DoS via kernel UAF); it does not cross a VM, IOMMU, or other separate security boundary.\nC:H - This is a use-after-free of scpi_drvinfo exported through get_scpi_ops(); with heap reuse the attacker can control the returned scpi_ops and adjacent state, enabling arbitrary kernel reads.\nI:H - UAF of the ops/channel state enables forged function pointers and writes through SCPI ops (clocks, DVFS, power, sensors), so integrity impact includes control-flow hijacking and arbitrary modification.\nA:H - The reported crash is a kernel oops/NULL instruction abort in scpi_hwmon_probe via the dangling scpi_info, and UAFs generally cause panics even when not fully exploited."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:57:21.727Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5aa558232edc30468d1f35108826dd5b3ffe978f"
        },
        {
          "url": "https://git.kernel.org/stable/c/18048cba444a7c41dbf42c180d6b46606fc24c51"
        },
        {
          "url": "https://git.kernel.org/stable/c/08272646cd7c310642c39b7f54348fddd7987643"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c29e149b6bb498778ed8a1c9597b51acfba7856"
        },
        {
          "url": "https://git.kernel.org/stable/c/87c4896d5dd7fd9927c814cf3c6289f41de3b562"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f2d7b46d6b53c07f44a4f8f8f4438888f0e9e87"
        },
        {
          "url": "https://git.kernel.org/stable/c/689640efc0a2c4e07e6f88affe6d42cd40cc3f85"
        }
      ],
      "title": "firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50087",
    "datePublished": "2025-06-18T11:02:28.079Z",
    "dateReserved": "2025-06-18T10:57:27.410Z",
    "dateUpdated": "2026-08-05T08:57:21.727Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50087",
      "date": "2026-09-26",
      "epss": "0.00196",
      "percentile": "0.08322"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/firmware/arm_scpi.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5aa558232edc30468d1f35108826dd5b3ffe978f",
                    "status": "affected",
                    "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "18048cba444a7c41dbf42c180d6b46606fc24c51",
                    "status": "affected",
                    "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "08272646cd7c310642c39b7f54348fddd7987643",
                    "status": "affected",
                    "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0c29e149b6bb498778ed8a1c9597b51acfba7856",
                    "status": "affected",
                    "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "87c4896d5dd7fd9927c814cf3c6289f41de3b562",
                    "status": "affected",
                    "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4f2d7b46d6b53c07f44a4f8f8f4438888f0e9e87",
                    "status": "affected",
                    "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "689640efc0a2c4e07e6f88affe6d42cd40cc3f85",
                    "status": "affected",
                    "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/firmware/arm_scpi.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.4"
                  },
                  {
                    "lessThan": "4.4",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.256",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.211",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.137",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.61",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.18.*",
                    "status": "unaffected",
                    "version": "5.18.18",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.19.*",
                    "status": "unaffected",
                    "version": "5.19.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3AC63550-1EF5-434E-B47C-A070C0D52954",
                    "versionEndExcluding": "4.19.256",
                    "versionStartIncluding": "4.4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B1C63D19-C08C-4308-A848-B2523C9275BD",
                    "versionEndExcluding": "5.4.211",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C2BF720F-C5EE-4DE2-9BDF-CE4CFBC767F4",
                    "versionEndExcluding": "5.10.137",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "51861563-7F40-460F-82CD-2D3FBDAD6618",
                    "versionEndExcluding": "5.15.61",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5B42E453-8837-49D0-A5EF-03F818A6DC11",
                    "versionEndExcluding": "5.18.18",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A1A2A5A5-4598-4D7E-BA07-4660398D6C8F",
                    "versionEndExcluding": "5.19.2",
                    "versionStartIncluding": "5.19",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails\n\nWhen scpi probe fails, at any point, we need to ensure that the scpi_info\nis not set and will remain NULL until the probe succeeds. If it is not\ntaken care, then it could result use-after-free as the value is exported\nvia get_scpi_ops() and could refer to a memory allocated via devm_kzalloc()\nbut freed when the probe fails."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: firmware: arm_scpi: Asegurarse de que scpi_info no se asigne si la sonda falla. Cuando la sonda scpi falla, en cualquier momento, debemos asegurarnos de que scpi_info no est\u00e9 configurado y permanezca nulo hasta que la sonda tenga \u00e9xito. Si no se soluciona, podr\u00eda producirse un error de Use-After-Free, ya que el valor se exporta mediante get_scpi_ops() y podr\u00eda hacer referencia a una memoria asignada mediante devm_kzalloc(), pero liberada cuando la sonda falla."
          }
        ],
        "id": "CVE-2022-50087",
        "lastModified": "2026-08-04T10:18:04.620",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-50087",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:41:34.847637Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-06-18T11:15:37.803",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/08272646cd7c310642c39b7f54348fddd7987643"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0c29e149b6bb498778ed8a1c9597b51acfba7856"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/18048cba444a7c41dbf42c180d6b46606fc24c51"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4f2d7b46d6b53c07f44a4f8f8f4438888f0e9e87"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5aa558232edc30468d1f35108826dd5b3ffe978f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/689640efc0a2c4e07e6f88affe6d42cd40cc3f85"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/87c4896d5dd7fd9927c814cf3c6289f41de3b562"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:41:01+00:00",
      "cve": "CVE-2022-50087",
      "id": "CVE-2022-50087",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "1695",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50087.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-12T23:59:05Z",
      "cve": "CVE-2022-50087",
      "id": "CVE-2022-50087",
      "initial_release_date": "2025-06-19T03:42:16Z",
      "product_status:known_affected": "441",
      "product_status:known_not_affected": "209",
      "product_status:recommended": "372",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50087",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50087.json",
      "version": "57"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-50087",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-10T20:41:34.847637Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-11T17:38:30.674Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/firmware/arm_scpi.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "5aa558232edc30468d1f35108826dd5b3ffe978f",
                  "status": "affected",
                  "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
                  "versionType": "git"
                },
                {
                  "lessThan": "18048cba444a7c41dbf42c180d6b46606fc24c51",
                  "status": "affected",
                  "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
                  "versionType": "git"
                },
                {
                  "lessThan": "08272646cd7c310642c39b7f54348fddd7987643",
                  "status": "affected",
                  "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
                  "versionType": "git"
                },
                {
                  "lessThan": "0c29e149b6bb498778ed8a1c9597b51acfba7856",
                  "status": "affected",
                  "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
                  "versionType": "git"
                },
                {
                  "lessThan": "87c4896d5dd7fd9927c814cf3c6289f41de3b562",
                  "status": "affected",
                  "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
                  "versionType": "git"
                },
                {
                  "lessThan": "4f2d7b46d6b53c07f44a4f8f8f4438888f0e9e87",
                  "status": "affected",
                  "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
                  "versionType": "git"
                },
                {
                  "lessThan": "689640efc0a2c4e07e6f88affe6d42cd40cc3f85",
                  "status": "affected",
                  "version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/firmware/arm_scpi.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.4"
                },
                {
                  "lessThan": "4.4",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.256",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.211",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.137",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.61",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.18.*",
                  "status": "unaffected",
                  "version": "5.18.18",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.19.*",
                  "status": "unaffected",
                  "version": "5.19.2",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.0",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.256",
                      "versionStartIncluding": "4.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.211",
                      "versionStartIncluding": "4.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.137",
                      "versionStartIncluding": "4.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.61",
                      "versionStartIncluding": "4.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.18.18",
                      "versionStartIncluding": "4.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.19.2",
                      "versionStartIncluding": "4.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.0",
                      "versionStartIncluding": "4.4",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails\n\nWhen scpi probe fails, at any point, we need to ensure that the scpi_info\nis not set and will remain NULL until the probe succeeds. If it is not\ntaken care, then it could result use-after-free as the value is exported\nvia get_scpi_ops() and could refer to a memory allocated via devm_kzalloc()\nbut freed when the probe fails."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-11T19:12:34.700Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/5aa558232edc30468d1f35108826dd5b3ffe978f"
            },
            {
              "url": "https://git.kernel.org/stable/c/18048cba444a7c41dbf42c180d6b46606fc24c51"
            },
            {
              "url": "https://git.kernel.org/stable/c/08272646cd7c310642c39b7f54348fddd7987643"
            },
            {
              "url": "https://git.kernel.org/stable/c/0c29e149b6bb498778ed8a1c9597b51acfba7856"
            },
            {
              "url": "https://git.kernel.org/stable/c/87c4896d5dd7fd9927c814cf3c6289f41de3b562"
            },
            {
              "url": "https://git.kernel.org/stable/c/4f2d7b46d6b53c07f44a4f8f8f4438888f0e9e87"
            },
            {
              "url": "https://git.kernel.org/stable/c/689640efc0a2c4e07e6f88affe6d42cd40cc3f85"
            }
          ],
          "title": "firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2022-50087",
        "datePublished": "2025-06-18T11:02:28.079Z",
        "dateReserved": "2025-06-18T10:57:27.410Z",
        "dateUpdated": "2026-06-11T18:44:13.909Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.