https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 17:09:23 +0000 https://cve.radiocsirt.org/vuln/cve-2022-50542 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>media: si470x: Fix use-after-free in si470x_int_in_callback()</p> <p>syzbot reported use-after-free in si470x_int_in_callback() [1]. This indicates that urb-&gt;context, which contains struct si470x_device object, is freed when si470x_int_in_callback() is called.</p> <p>The cause of this issue is that si470x_int_in_callback() is called for freed urb.</p> <p>si470x_usb_driver_probe() calls si470x_start_usb(), which then calls usb_submit_urb() and si470x_start(). If si470x_start_usb() fails, si470x_usb_driver_probe() doesn&#39;t kill urb, but it just frees struct si470x_device object, as depicted below:</p> <p>si470x_usb_driver_probe() ... si470x_start_usb() ... usb_submit_urb() retval = si470x_start() return retval if (retval &lt; 0) free struct si470x_device object, but don&#39;t kill urb</p> <p>This patch fixes this issue by killing urb when si470x_start_usb() fails and urb is submitted. If si470x_start_usb() fails and urb is not submitted, i.e. submitting usb fails, it just frees struct si470x_device object.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>media: si470x: Fix use-after-free in si470x_int_in_callback()</p> <p>syzbot reported use-after-free in si470x_int_in_callback() [1]. This indicates that urb-&gt;context, which contains struct si470x_device object, is freed when si470x_int_in_callback() is called.</p> <p>The cause of this issue is that si470x_int_in_callback() is called for freed urb.</p> <p>si470x_usb_driver_probe() calls si470x_start_usb(), which then calls usb_submit_urb() and si470x_start(). If si470x_start_usb() fails, si470x_usb_driver_probe() doesn&#39;t kill urb, but it just frees struct si470x_device object, as depicted below:</p> <p>si470x_usb_driver_probe() ... si470x_start_usb() ... usb_submit_urb() retval = si470x_start() return retval if (retval &lt; 0) free struct si470x_device object, but don&#39;t kill urb</p> <p>This patch fixes this issue by killing urb when si470x_start_usb() fails and urb is submitted. If si470x_start_usb() fails and urb is not submitted, i.e. submitting usb fails, it just frees struct si470x_device object.</p> https://cve.radiocsirt.org/vuln/cve-2022-50542