CVE-2022-50417
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2022
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
drm/panfrost: Fix GEM handle creation ref-counting
In the Linux kernel, the following vulnerability has been resolved: drm/panfrost: Fix GEM handle creation ref-counting panfrost_gem_create_with_handle() previously returned a BO but with the only reference being from the handle, which user space could in theory guess and release, causing a use-after-free. Additionally if the call to panfrost_gem_mapping_get() in panfrost_ioctl_create_bo() failed then a(nother) reference on the BO was dropped. The _create_with_handle() is a problematic pattern, so ditch it and instead create the handle in panfrost_ioctl_create_bo(). If the call to panfrost_gem_mapping_get() fails then this means that user space has indeed gone behind our back and freed the handle. In which case just return an error code.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| f3ba91228e8e917e5bd6c4b72bfe846933d17370 | affected | git | 0b70f6ea4d4f2b4d4b291d86ab76b4d07394932c | Unavailable | None listed |
| f3ba91228e8e917e5bd6c4b72bfe846933d17370 | affected | git | 4f1105ee72d8c7c35d90e3491b31b2d9d6b7e33a | Unavailable | None listed |
| f3ba91228e8e917e5bd6c4b72bfe846933d17370 | affected | git | 3f9feffa8a5ab08b4e298a27b1aa7204a7d42ca2 | Unavailable | None listed |
| f3ba91228e8e917e5bd6c4b72bfe846933d17370 | affected | git | ba3d2c2380e7129b525a787489c0b7e819a3b898 | Unavailable | None listed |
| f3ba91228e8e917e5bd6c4b72bfe846933d17370 | affected | git | 4217c6ac817451d5116687f3cc6286220dc43d49 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 5.2 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 5.2 | Unavailable | None listed |
| 5.10.163 | unaffected | semver | Unavailable | 5.10.* | None listed |
| 5.15.87 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 6.0.19 | unaffected | semver | Unavailable | 6.0.* | None listed |
| 6.1.5 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.2 | unaffected | original_commit_for_fix | Unavailable | * | None listed |