CVE-2022-50725 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
media: vidtv: Fix use-after-free in vidtv_bridge_dvb_init()
KASAN reports a use-after-free: BUG: KASAN: use-after-free in dvb_dmxdev_release+0x4d5/0x5d0 [dvb_core]
Call Trace: ... dvb_dmxdev_release+0x4d5/0x5d0 [dvb_core]
vidtv_bridge_probe+0x7bf/0xa40 [dvb_vidtv_bridge]
platform_probe+0xb6/0x170 ... Allocated by task 1238: ... dvb_register_device+0x1a7/0xa70 [dvb_core]
dvb_dmxdev_init+0x2af/0x4a0 [dvb_core]
vidtv_bridge_probe+0x766/0xa40 [dvb_vidtv_bridge]
... Freed by task 1238: dvb_register_device+0x6d2/0xa70 [dvb_core]
dvb_dmxdev_init+0x2af/0x4a0 [dvb_core]
vidtv_bridge_probe+0x766/0xa40 [dvb_vidtv_bridge]
...
It is because the error handling in vidtv_bridge_dvb_init() is wrong.
First, vidtv_bridge_dmx(dev)_init() will clean themselves when fail, but goto fail_dmx(_dev): calls release functions again, which causes use-after-free.
Also, in fail_fe, fail_tuner_probe and fail_demod_probe, j = i will cause out-of-bound when i finished its loop (i == NUM_FE). And the loop releasing is wrong, although now NUM_FE is 1 so it won't cause problem.
Fix this by correctly releasing everything.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/21/2026
The vulnerability identified as CVE-2022-50725 represents a critical use-after-free condition within the Linux kernel's media subsystem, specifically affecting the vidtv bridge driver component. This flaw exists in the dvb_vidtv_bridge module which handles digital video television bridge functionality for Linux-based systems. The issue manifests through kernel address sanitizer (KASAN) reporting mechanisms, indicating a dangerous memory access pattern that could potentially lead to system instability or arbitrary code execution. The vulnerability occurs during the initialization phase of the vidtv bridge device when handling DVB (Digital Video Broadcasting) device registration and setup processes.
The technical root cause stems from improper error handling within the vidtv_bridge_dvb_init() function, which manages the initialization of DVB components for the vidtv bridge driver. The flaw arises from duplicate cleanup operations where the vidtv_bridge_dmx_init() and vidtv_bridge_dmx_dev_init() functions perform their own cleanup when failures occur, yet the main initialization function subsequently calls release functions through goto fail_dmx_dev labels. This double-free pattern creates a use-after-free condition where memory that has already been freed is subsequently accessed, leading to potential memory corruption. The vulnerability also contains additional loop boundary issues in error handling paths where the variable j is assigned the value of i, causing out-of-bounds access when i reaches the NUM_FE limit, though this currently manifests as a non-critical issue due to NUM_FE being set to 1.
The operational impact of this vulnerability extends beyond simple system crashes, potentially enabling privilege escalation attacks and system compromise through memory corruption exploitation. Attackers could leverage this use-after-free condition to execute arbitrary code with kernel privileges, particularly targeting systems running Linux kernels with the affected dvb_vidtv_bridge module loaded. The vulnerability affects systems utilizing digital video broadcasting hardware that employs the vidtv bridge driver, making it relevant to various media processing and broadcasting applications. Security researchers categorize this as a use-after-free vulnerability, which aligns with CWE-416, representing an improper cleanup of memory resources. The attack surface is particularly concerning within embedded systems and media servers that rely on Linux kernel DVB subsystem functionality for television and broadcast processing operations.
Mitigation strategies should prioritize immediate kernel updates to versions containing the patched implementation of vidtv_bridge_dvb_init() function, ensuring proper resource cleanup without duplicate operations. System administrators should also implement monitoring for KASAN reports and memory corruption patterns that might indicate exploitation attempts. The fix involves restructuring the error handling paths to prevent duplicate cleanup operations while ensuring proper loop boundary conditions are maintained during resource release sequences. Additional defensive measures include implementing kernel module hardening techniques such as stack canaries and memory protection mechanisms, though the primary solution remains applying the patched kernel version that correctly handles resource allocation and deallocation sequences. Organizations should conduct thorough vulnerability assessments of their media processing systems to identify and remediate any potential exposure to this use-after-free condition.