CVE-2022-50454
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2022
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table() nouveau_bo_init() is backed by ttm_bo_init() and ferries its return code back to the caller. On failures, ttm will call nouveau_bo_del_ttm() and free the memory.Thus, when nouveau_bo_init() returns an error, the gem object has already been released. Then the call to nouveau_bo_ref() will use the freed "nvbo->bo" and lead to a use-after-free bug. We should delete the call to nouveau_bo_ref() to avoid the use-after-free.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 | affected | git | 56ee9577915dc06f55309901012a9ef68dbdb5a8 | Unavailable | None listed |
| 019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 | affected | git | 5d6093c49c098d86c7b136aba9922df44aeb6944 | Unavailable | None listed |
| 019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 | affected | git | 861f085f81fd569b02cc2c11165a9e6cca144424 | Unavailable | None listed |
| 019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 | affected | git | 3aeda2fe6517cc52663d4ce3588dd43f0d4124a7 | Unavailable | None listed |
| 019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 | affected | git | 7d80473e9f12548ac05b36af4fb9ce80f2f73509 | Unavailable | None listed |
| 019cbd4a4feb3aa3a917d78e7110e3011bbff6d5 | affected | git | 540dfd188ea2940582841c1c220bd035a7db0e51 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 5.4 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 5.4 | Unavailable | None listed |
| 5.4.220 | unaffected | semver | Unavailable | 5.4.* | None listed |
| 5.10.150 | unaffected | semver | Unavailable | 5.10.* | None listed |
| 5.15.75 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 5.19.17 | unaffected | semver | Unavailable | 5.19.* | None listed |
| 6.0.3 | unaffected | semver | Unavailable | 6.0.* | None listed |
| 6.1 | unaffected | original_commit_for_fix | Unavailable | * | None listed |