CVE-2022-50725

Vulnerability

CVE-2022-50725 is a use-after-free vulnerability in the Linux kernel's vidtv media driver, specifically in the vidtv_bridge_dvb_init() function. The root cause is flawed error handling: when a failure occurs during device initialization, the functions vidtv_bridge_dmx(dev)_init() clean up their own resources, but the code then jumps to a fail_dmx(_dev) label that calls release functions a second time, leading to a use-after-free condition. A KASAN report demonstrates the freed memory being accessed in dvb_dmxdev_release() [1].

Exploitation

An attacker would need the ability to trigger the vidtv_bridge_probe() call, which occurs during driver initialization. This is typically possible only with physical access to the system or by loading the vidtv module from within the kernel, making exploitation unlikely in ordinary desktop or server environments. The vulnerability is triggered during probe error handling, when a subsystem (like the DVB frontend or demux) fails and the driver cleans up incorrectly.

Impact

Successful exploitation could cause a kernel crash (denial of service) or potentially allow an attacker to execute arbitrary code in kernel context, depending on memory layout and timing. The use-after-free occurs in core DVB functions, so an attacker who can control the freed memory could corrupt kernel structures.

Mitigation

The vulnerability is fixed in Linux kernel commit c290aa527fd8, applied to stable trees [2][3]. Users should update to a kernel version containing the fix. No workaround is available; the vidtv driver is typically not enabled in production systems, so disabling or not building the CONFIG_DVB_VIDTV_BRIDGE option eliminates exposure.