CVE-2022-50412

drm: bridge: adv7511: unregister cec i2c device after cec adapter

High · published September 18, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
6.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

drm: bridge: adv7511: unregister cec i2c device after cec adapter

cec_unregister_adapter() assumes that the underlying adapter ops are

callable. For example, if the CEC adapter currently has a valid physical

address, then the unregistration procedure will invalidate the physical

address by setting it to f.f.f.f. Whence the following kernel oops

observed after removing the adv7511 module:

Unable to handle kernel execution of user memory at virtual address 0000000000000000

Internal error: Oops: 86000004 [#1] PREEMPT_RT SMP

Call trace:

0x0

adv7511_cec_adap_log_addr+0x1ac/0x1c8 [adv7511]

cec_adap_unconfigure+0x44/0x90 [cec]

__cec_s_phys_addr.part.0+0x68/0x230 [cec]

__cec_s_phys_addr+0x40/0x50 [cec]

cec_unregister_adapter+0xb4/0x118 [cec]

adv7511_remove+0x60/0x90 [adv7511]

i2c_device_remove+0x34/0xe0

device_release_driver_internal+0x114/0x1f0

driver_detach+0x54/0xe0

bus_remove_driver+0x60/0xd8

driver_unregister+0x34/0x60

i2c_del_driver+0x2c/0x68

adv7511_exit+0x1c/0x67c [adv7511]

__arm64_sys_delete_module+0x154/0x288

invoke_syscall+0x48/0x100

el0_svc_common.constprop.0+0x48/0xe8

do_el0_svc+0x28/0x88

el0_svc+0x1c/0x50

el0t_64_sync_handler+0xa8/0xb0

el0t_64_sync+0x15c/0x160

Code: bad PC value

---[ end trace 0000000000000000 ]---

Protect against this scenario by unregistering i2c_cec after

unregistering the CEC adapter. Duly disable the CEC clock afterwards

too.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00177 · 6.9th percentile
Published
2025-09-18T16:03Z
EPSS history
Timeline
  • 18 SEP 16:03Z
    drm: bridge: adv7511: unregister cec i2c device after cec adapter
    cvelistv5