GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50423 (GCVE-0-2022-50423)

Vulnerability from cvelistv5 – Published: 2025-10-01 11:41 – Updated: 2026-08-05 08:58
VLAI
Title
ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()
Summary
In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() There is an use-after-free reported by KASAN: BUG: KASAN: use-after-free in acpi_ut_remove_reference+0x3b/0x82 Read of size 1 at addr ffff888112afc460 by task modprobe/2111 CPU: 0 PID: 2111 Comm: modprobe Not tainted 6.1.0-rc7-dirty Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), Call Trace: <TASK> kasan_report+0xae/0xe0 acpi_ut_remove_reference+0x3b/0x82 acpi_ut_copy_iobject_to_iobject+0x3be/0x3d5 acpi_ds_store_object_to_local+0x15d/0x3a0 acpi_ex_store+0x78d/0x7fd acpi_ex_opcode_1A_1T_1R+0xbe4/0xf9b acpi_ps_parse_aml+0x217/0x8d5 ... </TASK> The root cause of the problem is that the acpi_operand_object is freed when acpi_ut_walk_package_tree() fails in acpi_ut_copy_ipackage_to_ipackage(), lead to repeated release in acpi_ut_copy_iobject_to_iobject(). The problem was introduced by "8aa5e56eeb61" commit, this commit is to fix memory leak in acpi_ut_copy_iobject_to_iobject(), repeatedly adding remove operation, lead to "acpi_operand_object" used after free. Fix it by removing acpi_ut_remove_reference() in acpi_ut_copy_ipackage_to_ipackage(). acpi_ut_copy_ipackage_to_ipackage() is called to copy an internal package object into another internal package object, when it fails, the memory of acpi_operand_object should be freed by the caller.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 17:39 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce , < 133462d35dae95edb944af86b986d4c9dec59bd1 (git)
Affected: 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce , < 02f237423c9c6a18e062de2d474f85d5659e4eb9 (git)
Affected: 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce , < c9125b643fc51b8e662f2f614096ceb45a0adbc3 (git)
Affected: 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce , < dfdde4d5138bc023897033a5ac653a84e94805be (git)
Affected: 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce , < 02617006b5a46f2ea55ac61f5693c7afd7bf9276 (git)
Affected: 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce , < 6fde666278f91b85d71545a0ebbf41d8d7af8074 (git)
Affected: 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce , < f51b2235e4f320edc839c3e5cb0d1f8a6e8657c6 (git)
Affected: 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce , < 01f2c2052ea50fb9a8ce12e4e83aed0267934ef0 (git)
Affected: 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce , < 470188b09e92d83c5a997f25f0e8fb8cd2bc3469 (git)
Affected: b3e98f0c4f996cd53b80bad71f0d7e4a2cf3a4e8 (git)
Affected: 7af5504c102a378376101dbd160246b10a814dd0 (git)
Affected: e29a15484d7ea949e49ae7fb7e576a575da824a6 (git)
Affected: e2ab6731a36966d042a2d4dabd980496cd680f75 (git)
Affected: 3.10.55 , < 3.11 (semver)
Affected: 3.12.29 , < 3.13 (semver)
Affected: 3.14.19 , < 3.15 (semver)
Affected: 3.16.3 , < 3.17 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 3.17
Unaffected: 0 , < 3.17 (semver)
Unaffected: 4.9.337 , ≤ 4.9.* (semver)
Unaffected: 4.14.303 , ≤ 4.14.* (semver)
Unaffected: 4.19.270 , ≤ 4.19.* (semver)
Unaffected: 5.4.229 , ≤ 5.4.* (semver)
Unaffected: 5.10.163 , ≤ 5.10.* (semver)
Unaffected: 5.15.86 , ≤ 5.15.* (semver)
Unaffected: 6.0.16 , ≤ 6.0.* (semver)
Unaffected: 6.1.2 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-50423",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T17:39:57.539191Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T17:42:46.653Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/acpi/acpica/utcopy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "133462d35dae95edb944af86b986d4c9dec59bd1",
              "status": "affected",
              "version": "8aa5e56eeb61a099ea6519eb30ee399e1bc043ce",
              "versionType": "git"
            },
            {
              "lessThan": "02f237423c9c6a18e062de2d474f85d5659e4eb9",
              "status": "affected",
              "version": "8aa5e56eeb61a099ea6519eb30ee399e1bc043ce",
              "versionType": "git"
            },
            {
              "lessThan": "c9125b643fc51b8e662f2f614096ceb45a0adbc3",
              "status": "affected",
              "version": "8aa5e56eeb61a099ea6519eb30ee399e1bc043ce",
              "versionType": "git"
            },
            {
              "lessThan": "dfdde4d5138bc023897033a5ac653a84e94805be",
              "status": "affected",
              "version": "8aa5e56eeb61a099ea6519eb30ee399e1bc043ce",
              "versionType": "git"
            },
            {
              "lessThan": "02617006b5a46f2ea55ac61f5693c7afd7bf9276",
              "status": "affected",
              "version": "8aa5e56eeb61a099ea6519eb30ee399e1bc043ce",
              "versionType": "git"
            },
            {
              "lessThan": "6fde666278f91b85d71545a0ebbf41d8d7af8074",
              "status": "affected",
              "version": "8aa5e56eeb61a099ea6519eb30ee399e1bc043ce",
              "versionType": "git"
            },
            {
              "lessThan": "f51b2235e4f320edc839c3e5cb0d1f8a6e8657c6",
              "status": "affected",
              "version": "8aa5e56eeb61a099ea6519eb30ee399e1bc043ce",
              "versionType": "git"
            },
            {
              "lessThan": "01f2c2052ea50fb9a8ce12e4e83aed0267934ef0",
              "status": "affected",
              "version": "8aa5e56eeb61a099ea6519eb30ee399e1bc043ce",
              "versionType": "git"
            },
            {
              "lessThan": "470188b09e92d83c5a997f25f0e8fb8cd2bc3469",
              "status": "affected",
              "version": "8aa5e56eeb61a099ea6519eb30ee399e1bc043ce",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b3e98f0c4f996cd53b80bad71f0d7e4a2cf3a4e8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7af5504c102a378376101dbd160246b10a814dd0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e29a15484d7ea949e49ae7fb7e576a575da824a6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e2ab6731a36966d042a2d4dabd980496cd680f75",
              "versionType": "git"
            },
            {
              "lessThan": "3.11",
              "status": "affected",
              "version": "3.10.55",
              "versionType": "semver"
            },
            {
              "lessThan": "3.13",
              "status": "affected",
              "version": "3.12.29",
              "versionType": "semver"
            },
            {
              "lessThan": "3.15",
              "status": "affected",
              "version": "3.14.19",
              "versionType": "semver"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/acpi/acpica/utcopy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.17"
            },
            {
              "lessThan": "3.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.337",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.303",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.229",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.337",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.303",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.270",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.229",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.163",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.86",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.16",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.2",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.10.55",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.12.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.14.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.16.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()\n\nThere is an use-after-free reported by KASAN:\n\n  BUG: KASAN: use-after-free in acpi_ut_remove_reference+0x3b/0x82\n  Read of size 1 at addr ffff888112afc460 by task modprobe/2111\n  CPU: 0 PID: 2111 Comm: modprobe Not tainted 6.1.0-rc7-dirty\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),\n  Call Trace:\n   \u003cTASK\u003e\n   kasan_report+0xae/0xe0\n   acpi_ut_remove_reference+0x3b/0x82\n   acpi_ut_copy_iobject_to_iobject+0x3be/0x3d5\n   acpi_ds_store_object_to_local+0x15d/0x3a0\n   acpi_ex_store+0x78d/0x7fd\n   acpi_ex_opcode_1A_1T_1R+0xbe4/0xf9b\n   acpi_ps_parse_aml+0x217/0x8d5\n   ...\n   \u003c/TASK\u003e\n\nThe root cause of the problem is that the acpi_operand_object\nis freed when acpi_ut_walk_package_tree() fails in\nacpi_ut_copy_ipackage_to_ipackage(), lead to repeated release in\nacpi_ut_copy_iobject_to_iobject(). The problem was introduced\nby \"8aa5e56eeb61\" commit, this commit is to fix memory leak in\nacpi_ut_copy_iobject_to_iobject(), repeatedly adding remove\noperation, lead to \"acpi_operand_object\" used after free.\n\nFix it by removing acpi_ut_remove_reference() in\nacpi_ut_copy_ipackage_to_ipackage(). acpi_ut_copy_ipackage_to_ipackage()\nis called to copy an internal package object into another internal\npackage object, when it fails, the memory of acpi_operand_object\nshould be freed by the caller."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is in the ACPICA AML interpreter (`acpi_ut_copy_ipackage_to_ipackage` during Store-to-Local), reached only via local ACPI table load or control-method evaluation; there is no network or adjacent-packet path into this code.\nAC:L - Once a firmware method Stores a shared package to a Local/Arg, the attacker can deterministically force the mid-walk AE_NO_MEMORY failure that triggers the double-free by exhausting memcg-accounted GFP_KERNEL allocations in the same process context that evaluates the method (e.g. container memory.max); no race or attacker-uncontrollable layout is required.\nPR:L - Unprivileged local users can drive ACPI method evaluation through world-readable ACPI/thermal/power sysfs attributes (0444) with no capability check; root-only interfaces such as configfs SSDT load or custom_method are not required on firmware that already Stores packages during those methods.\nUI:N - The attacker triggers evaluation directly via their own sysfs reads under memory pressure; no separate victim action such as mounting a filesystem is required.\nS:U - Impact is a host-kernel slab use-after-free within the same OS security authority; there is no VM escape, IOMMU bypass, or other cross-boundary compromise.\nC:H - The second `acpi_ut_remove_reference()` reads the already-freed Acpi-Operand object (as KASAN reported); reclaim/spray of that slab object yields an attacker-controlled read primitive, so confidentiality is High per UAF guidance.\nI:H - The same double-free of the package operand object is a classic heap UAF/double-free that enables spray-based arbitrary write and control-flow hijack primitives, so integrity is High.\nA:H - The bug was reported as a KASAN use-after-free and any second free or reuse of the dangling operand readily oopses/panics the kernel; per guidance any UAF is Availability High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:58:45.759Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/133462d35dae95edb944af86b986d4c9dec59bd1"
        },
        {
          "url": "https://git.kernel.org/stable/c/02f237423c9c6a18e062de2d474f85d5659e4eb9"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9125b643fc51b8e662f2f614096ceb45a0adbc3"
        },
        {
          "url": "https://git.kernel.org/stable/c/dfdde4d5138bc023897033a5ac653a84e94805be"
        },
        {
          "url": "https://git.kernel.org/stable/c/02617006b5a46f2ea55ac61f5693c7afd7bf9276"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fde666278f91b85d71545a0ebbf41d8d7af8074"
        },
        {
          "url": "https://git.kernel.org/stable/c/f51b2235e4f320edc839c3e5cb0d1f8a6e8657c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/01f2c2052ea50fb9a8ce12e4e83aed0267934ef0"
        },
        {
          "url": "https://git.kernel.org/stable/c/470188b09e92d83c5a997f25f0e8fb8cd2bc3469"
        }
      ],
      "title": "ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50423",
    "datePublished": "2025-10-01T11:41:56.083Z",
    "dateReserved": "2025-09-17T14:53:07.004Z",
    "dateUpdated": "2026-08-05T08:58:45.759Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50423",
      "date": "2026-09-16",
      "epss": "0.00163",
      "percentile": "0.05873"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50423\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-01T12:15:33.683\",\"lastModified\":\"2026-06-17T05:23:31.393\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()\\n\\nThere is an use-after-free reported by KASAN:\\n\\n  BUG: KASAN: use-after-free in acpi_ut_remove_reference+0x3b/0x82\\n  Read of size 1 at addr ffff888112afc460 by task modprobe/2111\\n  CPU: 0 PID: 2111 Comm: modprobe Not tainted 6.1.0-rc7-dirty\\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),\\n  Call Trace:\\n   \u003cTASK\u003e\\n   kasan_report+0xae/0xe0\\n   acpi_ut_remove_reference+0x3b/0x82\\n   acpi_ut_copy_iobject_to_iobject+0x3be/0x3d5\\n   acpi_ds_store_object_to_local+0x15d/0x3a0\\n   acpi_ex_store+0x78d/0x7fd\\n   acpi_ex_opcode_1A_1T_1R+0xbe4/0xf9b\\n   acpi_ps_parse_aml+0x217/0x8d5\\n   ...\\n   \u003c/TASK\u003e\\n\\nThe root cause of the problem is that the acpi_operand_object\\nis freed when acpi_ut_walk_package_tree() fails in\\nacpi_ut_copy_ipackage_to_ipackage(), lead to repeated release in\\nacpi_ut_copy_iobject_to_iobject(). The problem was introduced\\nby \\\"8aa5e56eeb61\\\" commit, this commit is to fix memory leak in\\nacpi_ut_copy_iobject_to_iobject(), repeatedly adding remove\\noperation, lead to \\\"acpi_operand_object\\\" used after free.\\n\\nFix it by removing acpi_ut_remove_reference() in\\nacpi_ut_copy_ipackage_to_ipackage(). acpi_ut_copy_ipackage_to_ipackage()\\nis called to copy an internal package object into another internal\\npackage object, when it fails, the memory of acpi_operand_object\\nshould be freed by the caller.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/acpi/acpica/utcopy.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8aa5e56eeb61a099ea6519eb30ee399e1bc043ce\",\"lessThan\":\"133462d35dae95edb944af86b986d4c9dec59bd1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8aa5e56eeb61a099ea6519eb30ee399e1bc043ce\",\"lessThan\":\"02f237423c9c6a18e062de2d474f85d5659e4eb9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8aa5e56eeb61a099ea6519eb30ee399e1bc043ce\",\"lessThan\":\"c9125b643fc51b8e662f2f614096ceb45a0adbc3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8aa5e56eeb61a099ea6519eb30ee399e1bc043ce\",\"lessThan\":\"dfdde4d5138bc023897033a5ac653a84e94805be\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8aa5e56eeb61a099ea6519eb30ee399e1bc043ce\",\"lessThan\":\"02617006b5a46f2ea55ac61f5693c7afd7bf9276\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8aa5e56eeb61a099ea6519eb30ee399e1bc043ce\",\"lessThan\":\"6fde666278f91b85d71545a0ebbf41d8d7af8074\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8aa5e56eeb61a099ea6519eb30ee399e1bc043ce\",\"lessThan\":\"f51b2235e4f320edc839c3e5cb0d1f8a6e8657c6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8aa5e56eeb61a099ea6519eb30ee399e1bc043ce\",\"lessThan\":\"01f2c2052ea50fb9a8ce12e4e83aed0267934ef0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8aa5e56eeb61a099ea6519eb30ee399e1bc043ce\",\"lessThan\":\"470188b09e92d83c5a997f25f0e8fb8cd2bc3469\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b3e98f0c4f996cd53b80bad71f0d7e4a2cf3a4e8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7af5504c102a378376101dbd160246b10a814dd0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e29a15484d7ea949e49ae7fb7e576a575da824a6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2ab6731a36966d042a2d4dabd980496cd680f75\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3.10.55\",\"lessThan\":\"3.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.12.29\",\"lessThan\":\"3.13\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.14.19\",\"lessThan\":\"3.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.16.3\",\"lessThan\":\"3.17\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/acpi/acpica/utcopy.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.9.337\",\"lessThanOrEqual\":\"4.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.303\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.270\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.229\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.163\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.86\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0.16\",\"lessThanOrEqual\":\"6.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.2\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-01-14T17:39:57.539191Z\",\"id\":\"CVE-2022-50423\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.10.55\",\"versionEndExcluding\":\"3.11\",\"matchCriteriaId\":\"5A516330-2A83-4603-8C0E-BBDFEECC27E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.12.29\",\"versionEndExcluding\":\"3.13\",\"matchCriteriaId\":\"25875AFE-CAEF-4D99-9B64-23F2B24C08D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.14.19\",\"versionEndExcluding\":\"3.15\",\"matchCriteriaId\":\"5D53296D-7B6A-4B74-A72C-45082E6C8531\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.16.3\",\"versionEndExcluding\":\"4.9.337\",\"matchCriteriaId\":\"D40F5AA2-90E2-40CE-A033-F1CB0E73BF7C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10\",\"versionEndExcluding\":\"4.14.303\",\"matchCriteriaId\":\"1E7450AD-4739-46F0-B81B-C02E7B35A97B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.270\",\"matchCriteriaId\":\"AE8904A3-99BE-4E49-9682-1F90A6373F4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.229\",\"matchCriteriaId\":\"A0C0D95E-414A-445E-941B-3EF6A4D3A093\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.163\",\"matchCriteriaId\":\"D05D31FC-BD74-4F9E-B1D8-9CED62BE6F65\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.86\",\"matchCriteriaId\":\"47237296-55D1-4ED4-8075-D00FC85A61EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.0.16\",\"matchCriteriaId\":\"C720A569-3D93-4D77-95F6-E2B3A3267D9F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1\",\"versionEndExcluding\":\"6.1.2\",\"matchCriteriaId\":\"77239F4B-6BB2-4B9E-A654-36A52396116C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/01f2c2052ea50fb9a8ce12e4e83aed0267934ef0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/02617006b5a46f2ea55ac61f5693c7afd7bf9276\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/02f237423c9c6a18e062de2d474f85d5659e4eb9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/133462d35dae95edb944af86b986d4c9dec59bd1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/470188b09e92d83c5a997f25f0e8fb8cd2bc3469\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6fde666278f91b85d71545a0ebbf41d8d7af8074\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c9125b643fc51b8e662f2f614096ceb45a0adbc3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dfdde4d5138bc023897033a5ac653a84e94805be\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f51b2235e4f320edc839c3e5cb0d1f8a6e8657c6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-21T18:46:16+00:00",
      "cve": "CVE-2022-50423",
      "id": "CVE-2022-50423",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "120",
      "product_status:known_affected": "138",
      "product_status:known_not_affected": "104",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Information disclosure and denial of service via use-after-free in ACPI subsystem",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50423.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-05T17:05:56Z",
      "cve": "CVE-2022-50423",
      "id": "CVE-2022-50423",
      "initial_release_date": "2025-10-01T23:33:03Z",
      "product_status:known_affected": "491",
      "product_status:known_not_affected": "176",
      "product_status:recommended": "376",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50423",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50423.json",
      "version": "60"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-50423\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-14T17:39:57.539191Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-14T17:39:53.133Z\"}}], \"cna\": {\"title\": \"ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"8aa5e56eeb61a099ea6519eb30ee399e1bc043ce\", \"lessThan\": \"133462d35dae95edb944af86b986d4c9dec59bd1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8aa5e56eeb61a099ea6519eb30ee399e1bc043ce\", \"lessThan\": \"02f237423c9c6a18e062de2d474f85d5659e4eb9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8aa5e56eeb61a099ea6519eb30ee399e1bc043ce\", \"lessThan\": \"c9125b643fc51b8e662f2f614096ceb45a0adbc3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8aa5e56eeb61a099ea6519eb30ee399e1bc043ce\", \"lessThan\": \"dfdde4d5138bc023897033a5ac653a84e94805be\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8aa5e56eeb61a099ea6519eb30ee399e1bc043ce\", \"lessThan\": \"02617006b5a46f2ea55ac61f5693c7afd7bf9276\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8aa5e56eeb61a099ea6519eb30ee399e1bc043ce\", \"lessThan\": \"6fde666278f91b85d71545a0ebbf41d8d7af8074\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8aa5e56eeb61a099ea6519eb30ee399e1bc043ce\", \"lessThan\": \"f51b2235e4f320edc839c3e5cb0d1f8a6e8657c6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8aa5e56eeb61a099ea6519eb30ee399e1bc043ce\", \"lessThan\": \"01f2c2052ea50fb9a8ce12e4e83aed0267934ef0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8aa5e56eeb61a099ea6519eb30ee399e1bc043ce\", \"lessThan\": \"470188b09e92d83c5a997f25f0e8fb8cd2bc3469\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b3e98f0c4f996cd53b80bad71f0d7e4a2cf3a4e8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7af5504c102a378376101dbd160246b10a814dd0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e29a15484d7ea949e49ae7fb7e576a575da824a6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e2ab6731a36966d042a2d4dabd980496cd680f75\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/acpi/acpica/utcopy.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.17\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.17\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.9.337\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.9.*\"}, {\"status\": \"unaffected\", \"version\": \"4.14.303\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.270\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.229\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.163\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.86\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.0.16\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.0.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.2\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/acpi/acpica/utcopy.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/133462d35dae95edb944af86b986d4c9dec59bd1\"}, {\"url\": \"https://git.kernel.org/stable/c/02f237423c9c6a18e062de2d474f85d5659e4eb9\"}, {\"url\": \"https://git.kernel.org/stable/c/c9125b643fc51b8e662f2f614096ceb45a0adbc3\"}, {\"url\": \"https://git.kernel.org/stable/c/dfdde4d5138bc023897033a5ac653a84e94805be\"}, {\"url\": \"https://git.kernel.org/stable/c/02617006b5a46f2ea55ac61f5693c7afd7bf9276\"}, {\"url\": \"https://git.kernel.org/stable/c/6fde666278f91b85d71545a0ebbf41d8d7af8074\"}, {\"url\": \"https://git.kernel.org/stable/c/f51b2235e4f320edc839c3e5cb0d1f8a6e8657c6\"}, {\"url\": \"https://git.kernel.org/stable/c/01f2c2052ea50fb9a8ce12e4e83aed0267934ef0\"}, {\"url\": \"https://git.kernel.org/stable/c/470188b09e92d83c5a997f25f0e8fb8cd2bc3469\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()\\n\\nThere is an use-after-free reported by KASAN:\\n\\n  BUG: KASAN: use-after-free in acpi_ut_remove_reference+0x3b/0x82\\n  Read of size 1 at addr ffff888112afc460 by task modprobe/2111\\n  CPU: 0 PID: 2111 Comm: modprobe Not tainted 6.1.0-rc7-dirty\\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),\\n  Call Trace:\\n   \u003cTASK\u003e\\n   kasan_report+0xae/0xe0\\n   acpi_ut_remove_reference+0x3b/0x82\\n   acpi_ut_copy_iobject_to_iobject+0x3be/0x3d5\\n   acpi_ds_store_object_to_local+0x15d/0x3a0\\n   acpi_ex_store+0x78d/0x7fd\\n   acpi_ex_opcode_1A_1T_1R+0xbe4/0xf9b\\n   acpi_ps_parse_aml+0x217/0x8d5\\n   ...\\n   \u003c/TASK\u003e\\n\\nThe root cause of the problem is that the acpi_operand_object\\nis freed when acpi_ut_walk_package_tree() fails in\\nacpi_ut_copy_ipackage_to_ipackage(), lead to repeated release in\\nacpi_ut_copy_iobject_to_iobject(). The problem was introduced\\nby \\\"8aa5e56eeb61\\\" commit, this commit is to fix memory leak in\\nacpi_ut_copy_iobject_to_iobject(), repeatedly adding remove\\noperation, lead to \\\"acpi_operand_object\\\" used after free.\\n\\nFix it by removing acpi_ut_remove_reference() in\\nacpi_ut_copy_ipackage_to_ipackage(). acpi_ut_copy_ipackage_to_ipackage()\\nis called to copy an internal package object into another internal\\npackage object, when it fails, the memory of acpi_operand_object\\nshould be freed by the caller.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.9.337\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.14.303\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.270\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.229\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.163\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.86\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.0.16\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.2\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.2\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.10.55\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.12.29\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.14.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.16.3\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T19:19:12.324Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-50423\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T19:19:12.324Z\", \"dateReserved\": \"2025-09-17T14:53:07.004Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-10-01T11:41:56.083Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.