GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50750 (GCVE-0-2022-50750)

Vulnerability from cvelistv5 – Published: 2025-12-24 13:05 – Updated: 2026-08-05 08:59
VLAI
Title
drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure In case mipi_dsi_attach() fails, call drm_panel_remove() to avoid memory leak.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 849b2e3ff9698226ab91e034d52cbb1da92a5b4c , < 0b7c47b7f358f932159a9d5beec9616ef8a0c6b4 (git)
Affected: 849b2e3ff9698226ab91e034d52cbb1da92a5b4c , < 576828e59a0e03bbc763872912b04f3e3a1b3311 (git)
Affected: 849b2e3ff9698226ab91e034d52cbb1da92a5b4c , < 13fc167e1645c43c631d7752d98e377f0e4cbb15 (git)
Affected: 849b2e3ff9698226ab91e034d52cbb1da92a5b4c , < 23fddf78eac8d79c56f93ab69b6c47a0816967c9 (git)
Affected: 849b2e3ff9698226ab91e034d52cbb1da92a5b4c , < 465611e812587e72bf235034edce0e51be3d6809 (git)
Affected: 849b2e3ff9698226ab91e034d52cbb1da92a5b4c , < c62102165dd79284d42383d2f7ed17301bd8e629 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.1
Unaffected: 0 , < 5.1 (semver)
Unaffected: 5.4.229 , ≤ 5.4.* (semver)
Unaffected: 5.10.163 , ≤ 5.10.* (semver)
Unaffected: 5.15.86 , ≤ 5.15.* (semver)
Unaffected: 6.0.16 , ≤ 6.0.* (semver)
Unaffected: 6.1.2 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panel/panel-sitronix-st7701.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0b7c47b7f358f932159a9d5beec9616ef8a0c6b4",
              "status": "affected",
              "version": "849b2e3ff9698226ab91e034d52cbb1da92a5b4c",
              "versionType": "git"
            },
            {
              "lessThan": "576828e59a0e03bbc763872912b04f3e3a1b3311",
              "status": "affected",
              "version": "849b2e3ff9698226ab91e034d52cbb1da92a5b4c",
              "versionType": "git"
            },
            {
              "lessThan": "13fc167e1645c43c631d7752d98e377f0e4cbb15",
              "status": "affected",
              "version": "849b2e3ff9698226ab91e034d52cbb1da92a5b4c",
              "versionType": "git"
            },
            {
              "lessThan": "23fddf78eac8d79c56f93ab69b6c47a0816967c9",
              "status": "affected",
              "version": "849b2e3ff9698226ab91e034d52cbb1da92a5b4c",
              "versionType": "git"
            },
            {
              "lessThan": "465611e812587e72bf235034edce0e51be3d6809",
              "status": "affected",
              "version": "849b2e3ff9698226ab91e034d52cbb1da92a5b4c",
              "versionType": "git"
            },
            {
              "lessThan": "c62102165dd79284d42383d2f7ed17301bd8e629",
              "status": "affected",
              "version": "849b2e3ff9698226ab91e034d52cbb1da92a5b4c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panel/panel-sitronix-st7701.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.229",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.229",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.163",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.86",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.16",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.2",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure\n\nIn case mipi_dsi_attach() fails, call drm_panel_remove() to\navoid memory leak."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in the ST7701 MIPI-DSI panel probe path (st7701_dsi_probe \u2192 drm_panel_add \u2192 mipi_dsi_attach) and is subsequently hit via local DRM panel lookup (of_drm_find_panel walking panel_list); it is not reachable from network or adjacent-link packet processing.\nAC:L - mipi_dsi_attach commonly returns -EPROBE_DEFER/-EBUSY/-EINVAL on componentized DSI hosts (dw-mipi-dsi, Rockchip, MediaTek, sun6i), and on that failure path the dangling panel remains on panel_list while DEV_M frees st7701; a later of_drm_find_panel walk then deterministically uses the freed object with no attacker-uncontrollable race.\nPR:L - On realistic ST7701 deployments (e.g. Rockchip handhelds/HMI such as Odroid Go with sitronix,st7701), deferred-probe attach failure can establish the dangling panel_list entry at boot without privileges, and an unprivileged seat/video user can then trigger DRM connector/panel lookup; real init-namespace root is not required.\nUI:N - No separate victim action is required; boot-time probe deferral/failure plus the attacker\u2019s own DRM modeset/connector probe ioctls drive the vulnerable path.\nS:U - Impact is confined to host-kernel heap corruption within the same OS security authority; this is not a VM escape, IOMMU/DMA bypass, or other cross-boundary compromise.\nC:H - Leaving \u0026st7701-\u003epanel on the global panel_list after DEV_M frees st7701 is a reclaimable heap use-after-free; of_drm_find_panel reads panel-\u003edev through that freed object, enabling arbitrary kernel read primitives via heap reuse.\nI:H - The same UAF lets an attacker reclaim and reshape the freed st7701/drm_panel object so later panel_list consumers act on attacker-controlled function pointers/state, enabling arbitrary write and control-flow hijacking.\nA:H - Dereferencing the dangling panel_list entry (panel-\u003edev / panel ops) causes kernel oops/panic even without full exploitation, which is Availability High under kernel CVSS guidance for UAFs/crashes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:59:38.061Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0b7c47b7f358f932159a9d5beec9616ef8a0c6b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/576828e59a0e03bbc763872912b04f3e3a1b3311"
        },
        {
          "url": "https://git.kernel.org/stable/c/13fc167e1645c43c631d7752d98e377f0e4cbb15"
        },
        {
          "url": "https://git.kernel.org/stable/c/23fddf78eac8d79c56f93ab69b6c47a0816967c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/465611e812587e72bf235034edce0e51be3d6809"
        },
        {
          "url": "https://git.kernel.org/stable/c/c62102165dd79284d42383d2f7ed17301bd8e629"
        }
      ],
      "title": "drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50750",
    "datePublished": "2025-12-24T13:05:45.447Z",
    "dateReserved": "2025-12-24T13:02:21.544Z",
    "dateUpdated": "2026-08-05T08:59:38.061Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50750",
      "date": "2026-09-19",
      "epss": "0.002",
      "percentile": "0.10237"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/panel/panel-sitronix-st7701.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0b7c47b7f358f932159a9d5beec9616ef8a0c6b4",
                    "status": "affected",
                    "version": "849b2e3ff9698226ab91e034d52cbb1da92a5b4c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "576828e59a0e03bbc763872912b04f3e3a1b3311",
                    "status": "affected",
                    "version": "849b2e3ff9698226ab91e034d52cbb1da92a5b4c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "13fc167e1645c43c631d7752d98e377f0e4cbb15",
                    "status": "affected",
                    "version": "849b2e3ff9698226ab91e034d52cbb1da92a5b4c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "23fddf78eac8d79c56f93ab69b6c47a0816967c9",
                    "status": "affected",
                    "version": "849b2e3ff9698226ab91e034d52cbb1da92a5b4c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "465611e812587e72bf235034edce0e51be3d6809",
                    "status": "affected",
                    "version": "849b2e3ff9698226ab91e034d52cbb1da92a5b4c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c62102165dd79284d42383d2f7ed17301bd8e629",
                    "status": "affected",
                    "version": "849b2e3ff9698226ab91e034d52cbb1da92a5b4c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/panel/panel-sitronix-st7701.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.1"
                  },
                  {
                    "lessThan": "5.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.229",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.163",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.86",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.0.*",
                    "status": "unaffected",
                    "version": "6.0.16",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure\n\nIn case mipi_dsi_attach() fails, call drm_panel_remove() to\navoid memory leak."
          }
        ],
        "id": "CVE-2022-50750",
        "lastModified": "2026-08-04T10:18:23.107",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-24T13:16:01.720",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0b7c47b7f358f932159a9d5beec9616ef8a0c6b4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/13fc167e1645c43c631d7752d98e377f0e4cbb15"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/23fddf78eac8d79c56f93ab69b6c47a0816967c9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/465611e812587e72bf235034edce0e51be3d6809"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/576828e59a0e03bbc763872912b04f3e3a1b3311"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c62102165dd79284d42383d2f7ed17301bd8e629"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:58:37+00:00",
      "cve": "CVE-2022-50750",
      "id": "CVE-2022-50750",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "120",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "134",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50750.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-08-29T02:19:04Z",
      "cve": "CVE-2022-50750",
      "id": "CVE-2022-50750",
      "initial_release_date": "2025-12-25T01:04:14Z",
      "product_status:known_affected": "354",
      "product_status:known_not_affected": "359",
      "product_status:recommended": "245",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50750",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50750.json",
      "version": "28"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.