CVE-2022-50499

media: dvb-core: Fix double free in dvb_register_device()

published October 4, 2025

CVSS
—
EPSS
0%
Percentile
5.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

media: dvb-core: Fix double free in dvb_register_device()

In function dvb_register_device() -> dvb_register_media_device() ->

dvb_create_media_entity(), dvb->entity is allocated and initialized. If

the initialization fails, it frees the dvb->entity, and return an error

code. The caller takes the error code and handles the error by calling

dvb_media_device_free(), which unregisters the entity and frees the

field again if it is not NULL. As dvb->entity may not NULLed in

dvb_create_media_entity() when the allocation of dvbdev->pad fails, a

double free may occur. This may also cause an Use After free in

media_device_unregister_entity().

Fix this by storing NULL to dvb->entity when it is freed.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00163 · 5.2th percentile
Published
2025-10-04T15:43Z
EPSS history
Timeline
  • 04 OCT 15:43Z
    media: dvb-core: Fix double free in dvb_register_device()
    cvelistv5