{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-50229","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-06-18T10:57:27.432Z","datePublished":"2025-06-18T11:04:06.069Z","dateUpdated":"2026-05-11T19:15:18.488Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-05-11T19:15:18.488Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: bcd2000: Fix a UAF bug on the error path of probing\n\nWhen the driver fails in snd_card_register() at probe time, it will free\nthe 'bcd2k->midi_out_urb' before killing it, which may cause a UAF bug.\n\nThe following log can reveal it:\n\n[   50.727020] BUG: KASAN: use-after-free in bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000]\n[   50.727623] Read of size 8 at addr ffff88810fab0e88 by task swapper/4/0\n[   50.729530] Call Trace:\n[   50.732899]  bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000]\n\nFix this by adding usb_kill_urb() before usb_free_urb()."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/usb/bcd2000/bcd2000.c"],"versions":[{"version":"b47a22290d581277be70e8a597824a4985d39e83","lessThan":"a718eba7e458e2f40531be3c6b6a0028ca7fcace","status":"affected","versionType":"git"},{"version":"b47a22290d581277be70e8a597824a4985d39e83","lessThan":"4fc41f7ebb7efca282f1740ea934d16f33c1d109","status":"affected","versionType":"git"},{"version":"b47a22290d581277be70e8a597824a4985d39e83","lessThan":"5e7338f4dd92b2f8915a82abfa1dd3ad3464bea0","status":"affected","versionType":"git"},{"version":"b47a22290d581277be70e8a597824a4985d39e83","lessThan":"05e0bb8c3c4dde3e21b9c1cf9395afb04e8b24db","status":"affected","versionType":"git"},{"version":"b47a22290d581277be70e8a597824a4985d39e83","lessThan":"348620464a5c127399ac09b266f494f393661952","status":"affected","versionType":"git"},{"version":"b47a22290d581277be70e8a597824a4985d39e83","lessThan":"64ca7f50ad96c2c65ae390b954925a36eabe04aa","status":"affected","versionType":"git"},{"version":"b47a22290d581277be70e8a597824a4985d39e83","lessThan":"1d6a246cf97c380f2da76591f03019dd9c9599c3","status":"affected","versionType":"git"},{"version":"b47a22290d581277be70e8a597824a4985d39e83","lessThan":"b0d4af0a4763ddc02344789ef2a281c494bc330d","status":"affected","versionType":"git"},{"version":"b47a22290d581277be70e8a597824a4985d39e83","lessThan":"ffb2759df7efbc00187bfd9d1072434a13a54139","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/usb/bcd2000/bcd2000.c"],"versions":[{"version":"3.16","status":"affected"},{"version":"0","lessThan":"3.16","status":"unaffected","versionType":"semver"},{"version":"4.9.326","lessThanOrEqual":"4.9.*","status":"unaffected","versionType":"semver"},{"version":"4.14.291","lessThanOrEqual":"4.14.*","status":"unaffected","versionType":"semver"},{"version":"4.19.256","lessThanOrEqual":"4.19.*","status":"unaffected","versionType":"semver"},{"version":"5.4.211","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.137","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.61","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"5.18.18","lessThanOrEqual":"5.18.*","status":"unaffected","versionType":"semver"},{"version":"5.19.2","lessThanOrEqual":"5.19.*","status":"unaffected","versionType":"semver"},{"version":"6.0","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16","versionEndExcluding":"4.9.326"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16","versionEndExcluding":"4.14.291"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16","versionEndExcluding":"4.19.256"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16","versionEndExcluding":"5.4.211"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16","versionEndExcluding":"5.10.137"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16","versionEndExcluding":"5.15.61"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16","versionEndExcluding":"5.18.18"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16","versionEndExcluding":"5.19.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16","versionEndExcluding":"6.0"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/a718eba7e458e2f40531be3c6b6a0028ca7fcace"},{"url":"https://git.kernel.org/stable/c/4fc41f7ebb7efca282f1740ea934d16f33c1d109"},{"url":"https://git.kernel.org/stable/c/5e7338f4dd92b2f8915a82abfa1dd3ad3464bea0"},{"url":"https://git.kernel.org/stable/c/05e0bb8c3c4dde3e21b9c1cf9395afb04e8b24db"},{"url":"https://git.kernel.org/stable/c/348620464a5c127399ac09b266f494f393661952"},{"url":"https://git.kernel.org/stable/c/64ca7f50ad96c2c65ae390b954925a36eabe04aa"},{"url":"https://git.kernel.org/stable/c/1d6a246cf97c380f2da76591f03019dd9c9599c3"},{"url":"https://git.kernel.org/stable/c/b0d4af0a4763ddc02344789ef2a281c494bc330d"},{"url":"https://git.kernel.org/stable/c/ffb2759df7efbc00187bfd9d1072434a13a54139"}],"title":"ALSA: bcd2000: Fix a UAF bug on the error path of probing","x_generator":{"engine":"bippy-1.2.0"}}}}