{"id":"DEBIAN-CVE-2022-50725","details":"In the Linux kernel, the following vulnerability has been resolved:  media: vidtv: Fix use-after-free in vidtv_bridge_dvb_init()  KASAN reports a use-after-free: BUG: KASAN: use-after-free in dvb_dmxdev_release+0x4d5/0x5d0 [dvb_core] Call Trace:  ...  dvb_dmxdev_release+0x4d5/0x5d0 [dvb_core]  vidtv_bridge_probe+0x7bf/0xa40 [dvb_vidtv_bridge]  platform_probe+0xb6/0x170  ... Allocated by task 1238:  ...  dvb_register_device+0x1a7/0xa70 [dvb_core]  dvb_dmxdev_init+0x2af/0x4a0 [dvb_core]  vidtv_bridge_probe+0x766/0xa40 [dvb_vidtv_bridge]  ... Freed by task 1238:  dvb_register_device+0x6d2/0xa70 [dvb_core]  dvb_dmxdev_init+0x2af/0x4a0 [dvb_core]  vidtv_bridge_probe+0x766/0xa40 [dvb_vidtv_bridge]  ...  It is because the error handling in vidtv_bridge_dvb_init() is wrong.  First, vidtv_bridge_dmx(dev)_init() will clean themselves when fail, but goto fail_dmx(_dev): calls release functions again, which causes use-after-free.  Also, in fail_fe, fail_tuner_probe and fail_demod_probe, j = i will cause out-of-bound when i finished its loop (i == NUM_FE). And the loop releasing is wrong, although now NUM_FE is 1 so it won't cause problem.  Fix this by correctly releasing everything.","modified":"2026-09-01T20:05:00.845136610Z","published":"2025-12-24T13:15:59.157Z","upstream":["CVE-2022-50725"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2022-50725"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50725.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50725.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-50725.json"}}],"schema_version":"1.9.0"}