Junglewise Threat Intelligence

CVE-2022-50560: Linux kernel drm/meson use-after-free in aggregate driver

CVE-2022-50560 · Severity: info · CVSS 0 · Published 2025-10-22

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's meson display driver fails to properly clean up its aggregate device when unloading, leaving stale pointers in memory. When the driver is reloaded, these pointers are dereferenced after the underlying memory has been freed, causing a kernel crash. This affects systems using Amlogic Meson-based SoCs (commonly found in media players and single-board computers).

Technical details

The vulnerability is a use-after-free bug in the drm/meson driver's module unload path. The root cause is that component_master_del() is not called when unloading the meson_drm module, leaving the aggregate device lingering in the global aggregate_devices list. When the meson_dw_hdmi module is subsequently reloaded, component_add() triggers try_to_bring_up_aggregate_device(), which dereferences stale pointers that were freed by devres cleanup during the previous unbind. The attack vector is local (requiring module load/unload operations) and can cause a denial of service through kernel panic. A fix is available in the kernel tree that explicitly calls component_master_del() during module unload.

Affected products

  • Linux Linux kernel up to 5.19-rc6 and likely later

Timeline

  • 2025-10-22: disclosed

Related threats