GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50384 (GCVE-0-2022-50384)

Vulnerability from cvelistv5 – Published: 2025-09-18 13:33 – Updated: 2026-08-05 08:58
VLAI
Title
staging: vme_user: Fix possible UAF in tsi148_dma_list_add
Summary
In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: Fix possible UAF in tsi148_dma_list_add Smatch report warning as follows: drivers/staging/vme_user/vme_tsi148.c:1757 tsi148_dma_list_add() warn: '&entry->list' not removed from list In tsi148_dma_list_add(), the error path "goto err_dma" will not remove entry->list from list->entries, but entry will be freed, then list traversal may cause UAF. Fix by removeing it from list->entries before free().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 18:48 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b2383c90a9d691201b9aee557776694cde86a935 , < 5cc4eea715a3fcf4e516662f736dfee63979465f (git)
Affected: b2383c90a9d691201b9aee557776694cde86a935 , < 51c0ad3b7c5b01f9314758335a13f157b05fa56d (git)
Affected: b2383c90a9d691201b9aee557776694cde86a935 , < e6b0adff99edf246ba1f8d464530a0438cb1cbda (git)
Affected: b2383c90a9d691201b9aee557776694cde86a935 , < a45ba33d398a821147d7e5f16ead7eb125e331e2 (git)
Affected: b2383c90a9d691201b9aee557776694cde86a935 , < 5d2b286eb034af114f67d9967fc3fbc1829bb712 (git)
Affected: b2383c90a9d691201b9aee557776694cde86a935 , < 1f5661388f43df3ac106ce93e67d8d22b16a78ff (git)
Affected: b2383c90a9d691201b9aee557776694cde86a935 , < cf138759a7e92c75cfc1b7ba705e4108fe330edf (git)
Affected: b2383c90a9d691201b9aee557776694cde86a935 , < 85db68fc901da52314ded80aace99f8b684c7815 (git)
Affected: b2383c90a9d691201b9aee557776694cde86a935 , < 357057ee55d3c99a5de5abe8150f7bca04f8e53b (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.2
Unaffected: 0 , < 4.2 (semver)
Unaffected: 4.9.337 , ≤ 4.9.* (semver)
Unaffected: 4.14.303 , ≤ 4.14.* (semver)
Unaffected: 4.19.270 , ≤ 4.19.* (semver)
Unaffected: 5.4.229 , ≤ 5.4.* (semver)
Unaffected: 5.10.163 , ≤ 5.10.* (semver)
Unaffected: 5.15.86 , ≤ 5.15.* (semver)
Unaffected: 6.0.16 , ≤ 6.0.* (semver)
Unaffected: 6.1.2 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-50384",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:48:36.418605Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T18:53:04.397Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/vme_user/vme_tsi148.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5cc4eea715a3fcf4e516662f736dfee63979465f",
              "status": "affected",
              "version": "b2383c90a9d691201b9aee557776694cde86a935",
              "versionType": "git"
            },
            {
              "lessThan": "51c0ad3b7c5b01f9314758335a13f157b05fa56d",
              "status": "affected",
              "version": "b2383c90a9d691201b9aee557776694cde86a935",
              "versionType": "git"
            },
            {
              "lessThan": "e6b0adff99edf246ba1f8d464530a0438cb1cbda",
              "status": "affected",
              "version": "b2383c90a9d691201b9aee557776694cde86a935",
              "versionType": "git"
            },
            {
              "lessThan": "a45ba33d398a821147d7e5f16ead7eb125e331e2",
              "status": "affected",
              "version": "b2383c90a9d691201b9aee557776694cde86a935",
              "versionType": "git"
            },
            {
              "lessThan": "5d2b286eb034af114f67d9967fc3fbc1829bb712",
              "status": "affected",
              "version": "b2383c90a9d691201b9aee557776694cde86a935",
              "versionType": "git"
            },
            {
              "lessThan": "1f5661388f43df3ac106ce93e67d8d22b16a78ff",
              "status": "affected",
              "version": "b2383c90a9d691201b9aee557776694cde86a935",
              "versionType": "git"
            },
            {
              "lessThan": "cf138759a7e92c75cfc1b7ba705e4108fe330edf",
              "status": "affected",
              "version": "b2383c90a9d691201b9aee557776694cde86a935",
              "versionType": "git"
            },
            {
              "lessThan": "85db68fc901da52314ded80aace99f8b684c7815",
              "status": "affected",
              "version": "b2383c90a9d691201b9aee557776694cde86a935",
              "versionType": "git"
            },
            {
              "lessThan": "357057ee55d3c99a5de5abe8150f7bca04f8e53b",
              "status": "affected",
              "version": "b2383c90a9d691201b9aee557776694cde86a935",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/vme_user/vme_tsi148.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.337",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.303",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.229",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.337",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.303",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.270",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.229",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.163",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.86",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.16",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.2",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: vme_user: Fix possible UAF in tsi148_dma_list_add\n\nSmatch report warning as follows:\n\ndrivers/staging/vme_user/vme_tsi148.c:1757 tsi148_dma_list_add() warn:\n  \u0027\u0026entry-\u003elist\u0027 not removed from list\n\nIn tsi148_dma_list_add(), the error path \"goto err_dma\" will not\nremove entry-\u003elist from list-\u003eentries, but entry will be freed,\nthen list traversal may cause UAF.\n\nFix by removeing it from list-\u003eentries before free()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is in the TSI148 VME bridge DMA-list builder (`tsi148_dma_list_add`), reached only through the local VME DMA API (`vme_dma_list_add`) used by VME device drivers on systems with the PCI TSI148 bridge\u2014not via network packets or physical attachment alone.\nAC:L - An attacker who can drive DMA-list add/free can induce a `dma_map_single` failure (IOVA/swiotlb exhaustion), leave the freed entry linked, then trigger UAF on the next add (`prev-\u003edescriptor` write), `tsi148_dma_list_exec`, or `tsi148_dma_list_empty`; no attacker-uncontrollable race is required.\nPR:L - The VME DMA path has no `capable()`/`CAP_*` gate\u2014only whatever DAC the consuming driver/device node applies. On TSI148 industrial/DAQ deployments (the intended consumers of this EXPORT_SYMBOL API), a non-root service account with VME device access is a reasonable worst case, matching CVE-2026-64449 for this subsystem.\nUI:N - The attacker initiates the DMA-list operations that hit the err_dma path and subsequent list walk themselves; no separate victim action is required.\nS:U - This is a standard in-kernel heap UAF within the host VME bridge driver and does not cross a VM, IOMMU, or other security-authority boundary.\nC:H - Use-after-free of the linked `tsi148_dma_entry` lets an attacker reclaim the object and control contents read on later list traversal/exec, enabling arbitrary kernel memory disclosure per UAF guidance.\nI:H - The same dangling list entry is written via the next-add prev-link update, and `tsi148_dma_list_empty` can double-free/unmap with a garbage `dma_handle`, yielding heap corruption and control-flow hijack primitives.\nA:H - Any subsequent list walk of the freed entry (empty/exec/add) can oops/panic the kernel, so availability impact is High even without full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:58:29.333Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5cc4eea715a3fcf4e516662f736dfee63979465f"
        },
        {
          "url": "https://git.kernel.org/stable/c/51c0ad3b7c5b01f9314758335a13f157b05fa56d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6b0adff99edf246ba1f8d464530a0438cb1cbda"
        },
        {
          "url": "https://git.kernel.org/stable/c/a45ba33d398a821147d7e5f16ead7eb125e331e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d2b286eb034af114f67d9967fc3fbc1829bb712"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f5661388f43df3ac106ce93e67d8d22b16a78ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf138759a7e92c75cfc1b7ba705e4108fe330edf"
        },
        {
          "url": "https://git.kernel.org/stable/c/85db68fc901da52314ded80aace99f8b684c7815"
        },
        {
          "url": "https://git.kernel.org/stable/c/357057ee55d3c99a5de5abe8150f7bca04f8e53b"
        }
      ],
      "title": "staging: vme_user: Fix possible UAF in tsi148_dma_list_add",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50384",
    "datePublished": "2025-09-18T13:33:05.759Z",
    "dateReserved": "2025-09-17T14:53:06.997Z",
    "dateUpdated": "2026-08-05T08:58:29.333Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50384",
      "date": "2026-09-16",
      "epss": "0.00167",
      "percentile": "0.06381"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50384\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-18T14:15:37.230\",\"lastModified\":\"2026-06-17T05:23:23.900\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nstaging: vme_user: Fix possible UAF in tsi148_dma_list_add\\n\\nSmatch report warning as follows:\\n\\ndrivers/staging/vme_user/vme_tsi148.c:1757 tsi148_dma_list_add() warn:\\n  \u0027\u0026entry-\u003elist\u0027 not removed from list\\n\\nIn tsi148_dma_list_add(), the error path \\\"goto err_dma\\\" will not\\nremove entry-\u003elist from list-\u003eentries, but entry will be freed,\\nthen list traversal may cause UAF.\\n\\nFix by removeing it from list-\u003eentries before free().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/staging/vme_user/vme_tsi148.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b2383c90a9d691201b9aee557776694cde86a935\",\"lessThan\":\"5cc4eea715a3fcf4e516662f736dfee63979465f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b2383c90a9d691201b9aee557776694cde86a935\",\"lessThan\":\"51c0ad3b7c5b01f9314758335a13f157b05fa56d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b2383c90a9d691201b9aee557776694cde86a935\",\"lessThan\":\"e6b0adff99edf246ba1f8d464530a0438cb1cbda\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b2383c90a9d691201b9aee557776694cde86a935\",\"lessThan\":\"a45ba33d398a821147d7e5f16ead7eb125e331e2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b2383c90a9d691201b9aee557776694cde86a935\",\"lessThan\":\"5d2b286eb034af114f67d9967fc3fbc1829bb712\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b2383c90a9d691201b9aee557776694cde86a935\",\"lessThan\":\"1f5661388f43df3ac106ce93e67d8d22b16a78ff\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b2383c90a9d691201b9aee557776694cde86a935\",\"lessThan\":\"cf138759a7e92c75cfc1b7ba705e4108fe330edf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b2383c90a9d691201b9aee557776694cde86a935\",\"lessThan\":\"85db68fc901da52314ded80aace99f8b684c7815\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b2383c90a9d691201b9aee557776694cde86a935\",\"lessThan\":\"357057ee55d3c99a5de5abe8150f7bca04f8e53b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/staging/vme_user/vme_tsi148.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.9.337\",\"lessThanOrEqual\":\"4.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.303\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.270\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.229\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.163\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.86\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0.16\",\"lessThanOrEqual\":\"6.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.2\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-01-14T18:48:36.418605Z\",\"id\":\"CVE-2022-50384\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.2\",\"versionEndExcluding\":\"4.9.337\",\"matchCriteriaId\":\"68CE101F-4861-4688-AA06-B428C2B72757\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10\",\"versionEndExcluding\":\"4.14.303\",\"matchCriteriaId\":\"1E7450AD-4739-46F0-B81B-C02E7B35A97B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.270\",\"matchCriteriaId\":\"AE8904A3-99BE-4E49-9682-1F90A6373F4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.229\",\"matchCriteriaId\":\"A0C0D95E-414A-445E-941B-3EF6A4D3A093\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.163\",\"matchCriteriaId\":\"D05D31FC-BD74-4F9E-B1D8-9CED62BE6F65\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.86\",\"matchCriteriaId\":\"47237296-55D1-4ED4-8075-D00FC85A61EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.0.16\",\"matchCriteriaId\":\"C720A569-3D93-4D77-95F6-E2B3A3267D9F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1\",\"versionEndExcluding\":\"6.1.2\",\"matchCriteriaId\":\"77239F4B-6BB2-4B9E-A654-36A52396116C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1f5661388f43df3ac106ce93e67d8d22b16a78ff\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/357057ee55d3c99a5de5abe8150f7bca04f8e53b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/51c0ad3b7c5b01f9314758335a13f157b05fa56d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5cc4eea715a3fcf4e516662f736dfee63979465f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5d2b286eb034af114f67d9967fc3fbc1829bb712\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/85db68fc901da52314ded80aace99f8b684c7815\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a45ba33d398a821147d7e5f16ead7eb125e331e2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cf138759a7e92c75cfc1b7ba705e4108fe330edf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e6b0adff99edf246ba1f8d464530a0438cb1cbda\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:24:17+00:00",
      "cve": "CVE-2022-50384",
      "id": "CVE-2022-50384",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: staging: vme_user: Fix possible UAF in tsi148_dma_list_add",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50384.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-04T00:34:04Z",
      "cve": "CVE-2022-50384",
      "id": "CVE-2022-50384",
      "initial_release_date": "2025-09-19T23:36:57Z",
      "product_status:known_affected": "318",
      "product_status:known_not_affected": "205",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50384",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50384.json",
      "version": "10"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-50384\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-14T18:48:36.418605Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-14T18:48:32.589Z\"}}], \"cna\": {\"title\": \"staging: vme_user: Fix possible UAF in tsi148_dma_list_add\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The UAF is in the TSI148 VME bridge DMA-list builder (`tsi148_dma_list_add`), reached only through the local VME DMA API (`vme_dma_list_add`) used by VME device drivers on systems with the PCI TSI148 bridge\\u2014not via network packets or physical attachment alone.\\nAC:L - An attacker who can drive DMA-list add/free can induce a `dma_map_single` failure (IOVA/swiotlb exhaustion), leave the freed entry linked, then trigger UAF on the next add (`prev-\u003edescriptor` write), `tsi148_dma_list_exec`, or `tsi148_dma_list_empty`; no attacker-uncontrollable race is required.\\nPR:L - The VME DMA path has no `capable()`/`CAP_*` gate\\u2014only whatever DAC the consuming driver/device node applies. On TSI148 industrial/DAQ deployments (the intended consumers of this EXPORT_SYMBOL API), a non-root service account with VME device access is a reasonable worst case, matching CVE-2026-64449 for this subsystem.\\nUI:N - The attacker initiates the DMA-list operations that hit the err_dma path and subsequent list walk themselves; no separate victim action is required.\\nS:U - This is a standard in-kernel heap UAF within the host VME bridge driver and does not cross a VM, IOMMU, or other security-authority boundary.\\nC:H - Use-after-free of the linked `tsi148_dma_entry` lets an attacker reclaim the object and control contents read on later list traversal/exec, enabling arbitrary kernel memory disclosure per UAF guidance.\\nI:H - The same dangling list entry is written via the next-add prev-link update, and `tsi148_dma_list_empty` can double-free/unmap with a garbage `dma_handle`, yielding heap corruption and control-flow hijack primitives.\\nA:H - Any subsequent list walk of the freed entry (empty/exec/add) can oops/panic the kernel, so availability impact is High even without full exploitation.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b2383c90a9d691201b9aee557776694cde86a935\", \"lessThan\": \"5cc4eea715a3fcf4e516662f736dfee63979465f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b2383c90a9d691201b9aee557776694cde86a935\", \"lessThan\": \"51c0ad3b7c5b01f9314758335a13f157b05fa56d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b2383c90a9d691201b9aee557776694cde86a935\", \"lessThan\": \"e6b0adff99edf246ba1f8d464530a0438cb1cbda\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b2383c90a9d691201b9aee557776694cde86a935\", \"lessThan\": \"a45ba33d398a821147d7e5f16ead7eb125e331e2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b2383c90a9d691201b9aee557776694cde86a935\", \"lessThan\": \"5d2b286eb034af114f67d9967fc3fbc1829bb712\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b2383c90a9d691201b9aee557776694cde86a935\", \"lessThan\": \"1f5661388f43df3ac106ce93e67d8d22b16a78ff\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b2383c90a9d691201b9aee557776694cde86a935\", \"lessThan\": \"cf138759a7e92c75cfc1b7ba705e4108fe330edf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b2383c90a9d691201b9aee557776694cde86a935\", \"lessThan\": \"85db68fc901da52314ded80aace99f8b684c7815\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b2383c90a9d691201b9aee557776694cde86a935\", \"lessThan\": \"357057ee55d3c99a5de5abe8150f7bca04f8e53b\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/staging/vme_user/vme_tsi148.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.9.337\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.9.*\"}, {\"status\": \"unaffected\", \"version\": \"4.14.303\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.270\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.229\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.163\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.86\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.0.16\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.0.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.2\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/staging/vme_user/vme_tsi148.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5cc4eea715a3fcf4e516662f736dfee63979465f\"}, {\"url\": \"https://git.kernel.org/stable/c/51c0ad3b7c5b01f9314758335a13f157b05fa56d\"}, {\"url\": \"https://git.kernel.org/stable/c/e6b0adff99edf246ba1f8d464530a0438cb1cbda\"}, {\"url\": \"https://git.kernel.org/stable/c/a45ba33d398a821147d7e5f16ead7eb125e331e2\"}, {\"url\": \"https://git.kernel.org/stable/c/5d2b286eb034af114f67d9967fc3fbc1829bb712\"}, {\"url\": \"https://git.kernel.org/stable/c/1f5661388f43df3ac106ce93e67d8d22b16a78ff\"}, {\"url\": \"https://git.kernel.org/stable/c/cf138759a7e92c75cfc1b7ba705e4108fe330edf\"}, {\"url\": \"https://git.kernel.org/stable/c/85db68fc901da52314ded80aace99f8b684c7815\"}, {\"url\": \"https://git.kernel.org/stable/c/357057ee55d3c99a5de5abe8150f7bca04f8e53b\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nstaging: vme_user: Fix possible UAF in tsi148_dma_list_add\\n\\nSmatch report warning as follows:\\n\\ndrivers/staging/vme_user/vme_tsi148.c:1757 tsi148_dma_list_add() warn:\\n  \u0027\u0026entry-\u003elist\u0027 not removed from list\\n\\nIn tsi148_dma_list_add(), the error path \\\"goto err_dma\\\" will not\\nremove entry-\u003elist from list-\u003eentries, but entry will be freed,\\nthen list traversal may cause UAF.\\n\\nFix by removeing it from list-\u003eentries before free().\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.9.337\", \"versionStartIncluding\": \"4.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.14.303\", \"versionStartIncluding\": \"4.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.270\", \"versionStartIncluding\": \"4.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.229\", \"versionStartIncluding\": \"4.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.163\", \"versionStartIncluding\": \"4.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.86\", \"versionStartIncluding\": \"4.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.0.16\", \"versionStartIncluding\": \"4.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.2\", \"versionStartIncluding\": \"4.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.2\", \"versionStartIncluding\": \"4.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:58:29.333Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-50384\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:58:29.333Z\", \"dateReserved\": \"2025-09-17T14:53:06.997Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-09-18T13:33:05.759Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.