CVE-2022-50417 (GCVE-0-2022-50417)

Vulnerability from cvelistv5 – Published: 2025-09-18 16:04 – Updated: 2026-08-05 08:58
VLAI
Title
drm/panfrost: Fix GEM handle creation ref-counting
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/panfrost: Fix GEM handle creation ref-counting panfrost_gem_create_with_handle() previously returned a BO but with the only reference being from the handle, which user space could in theory guess and release, causing a use-after-free. Additionally if the call to panfrost_gem_mapping_get() in panfrost_ioctl_create_bo() failed then a(nother) reference on the BO was dropped. The _create_with_handle() is a problematic pattern, so ditch it and instead create the handle in panfrost_ioctl_create_bo(). If the call to panfrost_gem_mapping_get() fails then this means that user space has indeed gone behind our back and freed the handle. In which case just return an error code.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 19:10 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f3ba91228e8e917e5bd6c4b72bfe846933d17370 , < 0b70f6ea4d4f2b4d4b291d86ab76b4d07394932c (git)
Affected: f3ba91228e8e917e5bd6c4b72bfe846933d17370 , < 4f1105ee72d8c7c35d90e3491b31b2d9d6b7e33a (git)
Affected: f3ba91228e8e917e5bd6c4b72bfe846933d17370 , < 3f9feffa8a5ab08b4e298a27b1aa7204a7d42ca2 (git)
Affected: f3ba91228e8e917e5bd6c4b72bfe846933d17370 , < ba3d2c2380e7129b525a787489c0b7e819a3b898 (git)
Affected: f3ba91228e8e917e5bd6c4b72bfe846933d17370 , < 4217c6ac817451d5116687f3cc6286220dc43d49 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.2
Unaffected: 0 , < 5.2 (semver)
Unaffected: 5.10.163 , ≤ 5.10.* (semver)
Unaffected: 5.15.87 , ≤ 5.15.* (semver)
Unaffected: 6.0.19 , ≤ 6.0.* (semver)
Unaffected: 6.1.5 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-50417",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T19:10:45.262200Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T19:13:09.937Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panfrost/panfrost_drv.c",
            "drivers/gpu/drm/panfrost/panfrost_gem.c",
            "drivers/gpu/drm/panfrost/panfrost_gem.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0b70f6ea4d4f2b4d4b291d86ab76b4d07394932c",
              "status": "affected",
              "version": "f3ba91228e8e917e5bd6c4b72bfe846933d17370",
              "versionType": "git"
            },
            {
              "lessThan": "4f1105ee72d8c7c35d90e3491b31b2d9d6b7e33a",
              "status": "affected",
              "version": "f3ba91228e8e917e5bd6c4b72bfe846933d17370",
              "versionType": "git"
            },
            {
              "lessThan": "3f9feffa8a5ab08b4e298a27b1aa7204a7d42ca2",
              "status": "affected",
              "version": "f3ba91228e8e917e5bd6c4b72bfe846933d17370",
              "versionType": "git"
            },
            {
              "lessThan": "ba3d2c2380e7129b525a787489c0b7e819a3b898",
              "status": "affected",
              "version": "f3ba91228e8e917e5bd6c4b72bfe846933d17370",
              "versionType": "git"
            },
            {
              "lessThan": "4217c6ac817451d5116687f3cc6286220dc43d49",
              "status": "affected",
              "version": "f3ba91228e8e917e5bd6c4b72bfe846933d17370",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panfrost/panfrost_drv.c",
            "drivers/gpu/drm/panfrost/panfrost_gem.c",
            "drivers/gpu/drm/panfrost/panfrost_gem.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.163",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.87",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.19",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.5",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panfrost: Fix GEM handle creation ref-counting\n\npanfrost_gem_create_with_handle() previously returned a BO but with the\nonly reference being from the handle, which user space could in theory\nguess and release, causing a use-after-free. Additionally if the call to\npanfrost_gem_mapping_get() in panfrost_ioctl_create_bo() failed then\na(nother) reference on the BO was dropped.\n\nThe _create_with_handle() is a problematic pattern, so ditch it and\ninstead create the handle in panfrost_ioctl_create_bo(). If the call to\npanfrost_gem_mapping_get() fails then this means that user space has\nindeed gone behind our back and freed the handle. In which case just\nreturn an error code."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via local DRM ioctls on the Panfrost render node (/dev/dri/renderD*): DRM_IOCTL_PANFROST_CREATE_BO and concurrent DRM_IOCTL_GEM_CLOSE. It is not reachable from network packet processing or adjacent-network protocols.\nAC:L - The attacker controls both sides of the race by issuing CREATE_BO on one thread while closing the predictable sequential IDR handle from another; GEM handles allocate from 1 upward so the next handle is trivial to guess. No conditions outside the attacker\u2019s influence are required.\nPR:L - CREATE_BO is marked DRM_RENDER_ALLOW and needs only an open render-node FD, which unprivileged users routinely have on Mali devices (Android phones, ARM SBCs). No CAP_SYS_ADMIN or init-namespace root is required.\nUI:N - The attacker triggers the UAF entirely with their own ioctls; no other user action such as mounting a filesystem or opening a malicious file is needed.\nS:U - This is a kernel heap use-after-free enabling privilege escalation within the same OS security authority. It does not cross a VM, IOMMU isolation, or other Changed-scope boundary.\nC:H - The dangling panfrost_gem_object pointer after GEM_CLOSE is a classic use-after-free; reclaiming the freed object via heap spray can yield arbitrary kernel memory reads.\nI:H - The same UAF/refcount corruption allows reallocation of the freed GEM object and adjacent structures, enabling arbitrary kernel writes and control-flow hijacking.\nA:H - Use of the freed BO (e.g., locking bo-\u003emappings.lock in panfrost_gem_mapping_get) or the erroneous extra drm_gem_object_put causes kernel oops/panic, so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:58:42.522Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0b70f6ea4d4f2b4d4b291d86ab76b4d07394932c"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f1105ee72d8c7c35d90e3491b31b2d9d6b7e33a"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f9feffa8a5ab08b4e298a27b1aa7204a7d42ca2"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba3d2c2380e7129b525a787489c0b7e819a3b898"
        },
        {
          "url": "https://git.kernel.org/stable/c/4217c6ac817451d5116687f3cc6286220dc43d49"
        }
      ],
      "title": "drm/panfrost: Fix GEM handle creation ref-counting",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50417",
    "datePublished": "2025-09-18T16:04:00.512Z",
    "dateReserved": "2025-09-17T14:53:07.003Z",
    "dateUpdated": "2026-08-05T08:58:42.522Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50417",
      "date": "2026-09-25",
      "epss": "0.00159",
      "percentile": "0.04313"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/panfrost/panfrost_drv.c",
                  "drivers/gpu/drm/panfrost/panfrost_gem.c",
                  "drivers/gpu/drm/panfrost/panfrost_gem.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0b70f6ea4d4f2b4d4b291d86ab76b4d07394932c",
                    "status": "affected",
                    "version": "f3ba91228e8e917e5bd6c4b72bfe846933d17370",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4f1105ee72d8c7c35d90e3491b31b2d9d6b7e33a",
                    "status": "affected",
                    "version": "f3ba91228e8e917e5bd6c4b72bfe846933d17370",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3f9feffa8a5ab08b4e298a27b1aa7204a7d42ca2",
                    "status": "affected",
                    "version": "f3ba91228e8e917e5bd6c4b72bfe846933d17370",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ba3d2c2380e7129b525a787489c0b7e819a3b898",
                    "status": "affected",
                    "version": "f3ba91228e8e917e5bd6c4b72bfe846933d17370",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4217c6ac817451d5116687f3cc6286220dc43d49",
                    "status": "affected",
                    "version": "f3ba91228e8e917e5bd6c4b72bfe846933d17370",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/panfrost/panfrost_drv.c",
                  "drivers/gpu/drm/panfrost/panfrost_gem.c",
                  "drivers/gpu/drm/panfrost/panfrost_gem.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.2"
                  },
                  {
                    "lessThan": "5.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.163",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.87",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.0.*",
                    "status": "unaffected",
                    "version": "6.0.19",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "627343D8-A155-4ECD-80DF-D7688941892E",
                    "versionEndExcluding": "5.10.163",
                    "versionStartIncluding": "5.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7B9E5B1C-CD46-4790-9500-615863850401",
                    "versionEndExcluding": "5.15.87",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B70FF53F-1F99-4483-9376-CBA1A4EE0351",
                    "versionEndExcluding": "6.0.19",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8C1E7766-4310-43F9-BAC4-3763A36C043A",
                    "versionEndExcluding": "6.1.5",
                    "versionStartIncluding": "6.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "FF501633-2F44-4913-A8EE-B021929F49F6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "2BDA597B-CAC1-4DF0-86F0-42E142C654E9",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panfrost: Fix GEM handle creation ref-counting\n\npanfrost_gem_create_with_handle() previously returned a BO but with the\nonly reference being from the handle, which user space could in theory\nguess and release, causing a use-after-free. Additionally if the call to\npanfrost_gem_mapping_get() in panfrost_ioctl_create_bo() failed then\na(nother) reference on the BO was dropped.\n\nThe _create_with_handle() is a problematic pattern, so ditch it and\ninstead create the handle in panfrost_ioctl_create_bo(). If the call to\npanfrost_gem_mapping_get() fails then this means that user space has\nindeed gone behind our back and freed the handle. In which case just\nreturn an error code."
          }
        ],
        "id": "CVE-2022-50417",
        "lastModified": "2026-06-17T05:23:30.363",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-50417",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T19:10:45.262200Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-09-18T16:15:45.123",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0b70f6ea4d4f2b4d4b291d86ab76b4d07394932c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3f9feffa8a5ab08b4e298a27b1aa7204a7d42ca2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4217c6ac817451d5116687f3cc6286220dc43d49"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4f1105ee72d8c7c35d90e3491b31b2d9d6b7e33a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ba3d2c2380e7129b525a787489c0b7e819a3b898"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:13:22+00:00",
      "cve": "CVE-2022-50417",
      "id": "CVE-2022-50417",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/panfrost: Fix GEM handle creation ref-counting",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50417.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-27T00:49:26Z",
      "cve": "CVE-2022-50417",
      "id": "CVE-2022-50417",
      "initial_release_date": "2025-09-18T23:42:51Z",
      "product_status:known_affected": "395",
      "product_status:known_not_affected": "253",
      "product_status:recommended": "206",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50417",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50417.json",
      "version": "30"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 7.8,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-50417",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-01-14T19:10:45.262200Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-416",
                    "description": "CWE-416 Use After Free",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-01-14T19:10:40.031Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/gpu/drm/panfrost/panfrost_drv.c",
                "drivers/gpu/drm/panfrost/panfrost_gem.c",
                "drivers/gpu/drm/panfrost/panfrost_gem.h"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "0b70f6ea4d4f2b4d4b291d86ab76b4d07394932c",
                  "status": "affected",
                  "version": "f3ba91228e8e917e5bd6c4b72bfe846933d17370",
                  "versionType": "git"
                },
                {
                  "lessThan": "4f1105ee72d8c7c35d90e3491b31b2d9d6b7e33a",
                  "status": "affected",
                  "version": "f3ba91228e8e917e5bd6c4b72bfe846933d17370",
                  "versionType": "git"
                },
                {
                  "lessThan": "3f9feffa8a5ab08b4e298a27b1aa7204a7d42ca2",
                  "status": "affected",
                  "version": "f3ba91228e8e917e5bd6c4b72bfe846933d17370",
                  "versionType": "git"
                },
                {
                  "lessThan": "ba3d2c2380e7129b525a787489c0b7e819a3b898",
                  "status": "affected",
                  "version": "f3ba91228e8e917e5bd6c4b72bfe846933d17370",
                  "versionType": "git"
                },
                {
                  "lessThan": "4217c6ac817451d5116687f3cc6286220dc43d49",
                  "status": "affected",
                  "version": "f3ba91228e8e917e5bd6c4b72bfe846933d17370",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/gpu/drm/panfrost/panfrost_drv.c",
                "drivers/gpu/drm/panfrost/panfrost_gem.c",
                "drivers/gpu/drm/panfrost/panfrost_gem.h"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.2"
                },
                {
                  "lessThan": "5.2",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.163",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.87",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.0.*",
                  "status": "unaffected",
                  "version": "6.0.19",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.5",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.2",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.163",
                      "versionStartIncluding": "5.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.87",
                      "versionStartIncluding": "5.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.0.19",
                      "versionStartIncluding": "5.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.5",
                      "versionStartIncluding": "5.2",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.2",
                      "versionStartIncluding": "5.2",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panfrost: Fix GEM handle creation ref-counting\n\npanfrost_gem_create_with_handle() previously returned a BO but with the\nonly reference being from the handle, which user space could in theory\nguess and release, causing a use-after-free. Additionally if the call to\npanfrost_gem_mapping_get() in panfrost_ioctl_create_bo() failed then\na(nother) reference on the BO was dropped.\n\nThe _create_with_handle() is a problematic pattern, so ditch it and\ninstead create the handle in panfrost_ioctl_create_bo(). If the call to\npanfrost_gem_mapping_get() fails then this means that user space has\nindeed gone behind our back and freed the handle. In which case just\nreturn an error code."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-11T19:19:05.512Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/0b70f6ea4d4f2b4d4b291d86ab76b4d07394932c"
            },
            {
              "url": "https://git.kernel.org/stable/c/4f1105ee72d8c7c35d90e3491b31b2d9d6b7e33a"
            },
            {
              "url": "https://git.kernel.org/stable/c/3f9feffa8a5ab08b4e298a27b1aa7204a7d42ca2"
            },
            {
              "url": "https://git.kernel.org/stable/c/ba3d2c2380e7129b525a787489c0b7e819a3b898"
            },
            {
              "url": "https://git.kernel.org/stable/c/4217c6ac817451d5116687f3cc6286220dc43d49"
            }
          ],
          "title": "drm/panfrost: Fix GEM handle creation ref-counting",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2022-50417",
        "datePublished": "2025-09-18T16:04:00.512Z",
        "dateReserved": "2025-09-17T14:53:07.003Z",
        "dateUpdated": "2026-05-11T19:19:05.512Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.