GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50005 (GCVE-0-2022-50005)

Vulnerability from cvelistv5 – Published: 2025-06-18 11:01 – Updated: 2026-05-11 19:10
VLAI
Title
nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout
Summary
In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout When the pn532 uart device is detaching, the pn532_uart_remove() is called. But there are no functions in pn532_uart_remove() that could delete the cmd_timeout timer, which will cause use-after-free bugs. The process is shown below: (thread 1) | (thread 2) | pn532_uart_send_frame pn532_uart_remove | mod_timer(&pn532->cmd_timeout,...) ... | (wait a time) kfree(pn532) //FREE | pn532_cmd_timeout | pn532_uart_send_frame | pn532->... //USE This patch adds del_timer_sync() in pn532_uart_remove() in order to prevent the use-after-free bugs. What's more, the pn53x_unregister_nfc() is well synchronized, it sets nfc_dev->shutting_down to true and there are no syscalls could restart the cmd_timeout timer.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c656aa4c27b17a8c70da223ed5ab42145800d6b5 , < 50403ee6daddf0d7a14e9d3b51a377c39a08ec8c (git)
Affected: c656aa4c27b17a8c70da223ed5ab42145800d6b5 , < 9c34c33893db7a80d0e4b55c23d3b65e29609cfb (git)
Affected: c656aa4c27b17a8c70da223ed5ab42145800d6b5 , < 2c71f5d55a86fd5969428abf525c1ae6b1c7b0f5 (git)
Affected: c656aa4c27b17a8c70da223ed5ab42145800d6b5 , < f1e941dbf80a9b8bab0bffbc4cbe41cc7f4c6fb6 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.5
Unaffected: 0 , < 5.5 (semver)
Unaffected: 5.10.140 , ≤ 5.10.* (semver)
Unaffected: 5.15.64 , ≤ 5.15.* (semver)
Unaffected: 5.19.6 , ≤ 5.19.* (semver)
Unaffected: 6.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nfc/pn533/uart.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "50403ee6daddf0d7a14e9d3b51a377c39a08ec8c",
              "status": "affected",
              "version": "c656aa4c27b17a8c70da223ed5ab42145800d6b5",
              "versionType": "git"
            },
            {
              "lessThan": "9c34c33893db7a80d0e4b55c23d3b65e29609cfb",
              "status": "affected",
              "version": "c656aa4c27b17a8c70da223ed5ab42145800d6b5",
              "versionType": "git"
            },
            {
              "lessThan": "2c71f5d55a86fd5969428abf525c1ae6b1c7b0f5",
              "status": "affected",
              "version": "c656aa4c27b17a8c70da223ed5ab42145800d6b5",
              "versionType": "git"
            },
            {
              "lessThan": "f1e941dbf80a9b8bab0bffbc4cbe41cc7f4c6fb6",
              "status": "affected",
              "version": "c656aa4c27b17a8c70da223ed5ab42145800d6b5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nfc/pn533/uart.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.140",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.64",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.6",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout\n\nWhen the pn532 uart device is detaching, the pn532_uart_remove()\nis called. But there are no functions in pn532_uart_remove() that\ncould delete the cmd_timeout timer, which will cause use-after-free\nbugs. The process is shown below:\n\n    (thread 1)                  |        (thread 2)\n                                |  pn532_uart_send_frame\npn532_uart_remove               |    mod_timer(\u0026pn532-\u003ecmd_timeout,...)\n  ...                           |    (wait a time)\n  kfree(pn532) //FREE           |    pn532_cmd_timeout\n                                |      pn532_uart_send_frame\n                                |        pn532-\u003e... //USE\n\nThis patch adds del_timer_sync() in pn532_uart_remove() in order to\nprevent the use-after-free bugs. What\u0027s more, the pn53x_unregister_nfc()\nis well synchronized, it sets nfc_dev-\u003eshutting_down to true and there\nare no syscalls could restart the cmd_timeout timer."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:10:53.002Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/50403ee6daddf0d7a14e9d3b51a377c39a08ec8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c34c33893db7a80d0e4b55c23d3b65e29609cfb"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c71f5d55a86fd5969428abf525c1ae6b1c7b0f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1e941dbf80a9b8bab0bffbc4cbe41cc7f4c6fb6"
        }
      ],
      "title": "nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50005",
    "datePublished": "2025-06-18T11:01:10.610Z",
    "dateReserved": "2025-06-18T10:57:27.388Z",
    "dateUpdated": "2026-05-11T19:10:53.002Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50005",
      "date": "2026-09-17",
      "epss": "0.00229",
      "percentile": "0.13831"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nfc/pn533/uart.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "50403ee6daddf0d7a14e9d3b51a377c39a08ec8c",
                    "status": "affected",
                    "version": "c656aa4c27b17a8c70da223ed5ab42145800d6b5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9c34c33893db7a80d0e4b55c23d3b65e29609cfb",
                    "status": "affected",
                    "version": "c656aa4c27b17a8c70da223ed5ab42145800d6b5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2c71f5d55a86fd5969428abf525c1ae6b1c7b0f5",
                    "status": "affected",
                    "version": "c656aa4c27b17a8c70da223ed5ab42145800d6b5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f1e941dbf80a9b8bab0bffbc4cbe41cc7f4c6fb6",
                    "status": "affected",
                    "version": "c656aa4c27b17a8c70da223ed5ab42145800d6b5",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/nfc/pn533/uart.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.5"
                  },
                  {
                    "lessThan": "5.5",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.140",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.64",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.19.*",
                    "status": "unaffected",
                    "version": "5.19.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A26216A8-920B-4892-A1EB-143451AFFC31",
                    "versionEndExcluding": "5.10.140",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "292F3687-ADC2-4F3D-9710-3BCAD11A52BE",
                    "versionEndExcluding": "5.15.64",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "89E99903-E16D-475D-954B-2BAC46C98262",
                    "versionEndExcluding": "5.19.6",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "E8BD11A3-8643-49B6-BADE-5029A0117325",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "5F0AD220-F6A9-4012-8636-155F1B841FAD",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout\n\nWhen the pn532 uart device is detaching, the pn532_uart_remove()\nis called. But there are no functions in pn532_uart_remove() that\ncould delete the cmd_timeout timer, which will cause use-after-free\nbugs. The process is shown below:\n\n    (thread 1)                  |        (thread 2)\n                                |  pn532_uart_send_frame\npn532_uart_remove               |    mod_timer(\u0026pn532-\u003ecmd_timeout,...)\n  ...                           |    (wait a time)\n  kfree(pn532) //FREE           |    pn532_cmd_timeout\n                                |      pn532_uart_send_frame\n                                |        pn532-\u003e... //USE\n\nThis patch adds del_timer_sync() in pn532_uart_remove() in order to\nprevent the use-after-free bugs. What\u0027s more, the pn53x_unregister_nfc()\nis well synchronized, it sets nfc_dev-\u003eshutting_down to true and there\nare no syscalls could restart the cmd_timeout timer."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nfc: pn533: Se corrigen los errores de Use-After-Free causados por pn532_cmd_timeout. Cuando se desconecta el dispositivo uart pn532, se llama a pn532_uart_remove(). Sin embargo, no hay funciones en pn532_uart_remove() que puedan eliminar el temporizador cmd_timeout, lo que causar\u00eda errores de Use-After-Free. El proceso se muestra a continuaci\u00f3n: (hilo 1) | (hilo 2) | pn532_uart_send_frame pn532_uart_remove | mod_timer(\u0026amp;pn532-\u0026gt;cmd_timeout,...) ... | (esperar un tiempo) kfree(pn532) //FREE | pn532_cmd_timeout | pn532_uart_send_frame | pn532-\u0026gt;... //USE Este parche a\u00f1ade del_timer_sync() a pn532_uart_remove() para evitar errores de Use-After-Free. Adem\u00e1s, pn53x_unregister_nfc() est\u00e1 bien sincronizado, establece nfc_dev-\u0026gt;shutting_down como verdadero y ninguna llamada al sistema podr\u00eda reiniciar el temporizador cmd_timeout."
          }
        ],
        "id": "CVE-2022-50005",
        "lastModified": "2026-06-17T05:22:32.403",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-06-18T11:15:28.397",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2c71f5d55a86fd5969428abf525c1ae6b1c7b0f5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/50403ee6daddf0d7a14e9d3b51a377c39a08ec8c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9c34c33893db7a80d0e4b55c23d3b65e29609cfb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f1e941dbf80a9b8bab0bffbc4cbe41cc7f4c6fb6"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-21T18:44:31+00:00",
      "cve": "CVE-2022-50005",
      "id": "CVE-2022-50005",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "2",
      "product_status:known_not_affected": "272",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50005.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:28:43Z",
      "cve": "CVE-2022-50005",
      "id": "CVE-2022-50005",
      "initial_release_date": "2025-06-19T03:44:15Z",
      "product_status:known_affected": "344",
      "product_status:known_not_affected": "388",
      "product_status:recommended": "235",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50005",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50005.json",
      "version": "42"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.