In the Linux kernel, the following vulnerability has been resolved:
media: dvbdev: adopts refcnt to avoid UAF
dvbunregisterdevice() is known that prone to use-after-free. That is, the cleanup from dvbunregisterdevice() releases the dvbdevice even if there are pointers stored in file->privatedata still refer to it.
This patch adds a reference counter into struct dvb_device and delays its deallocation until no pointer refers to the object.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50274.json",
"cna_assigner": "Linux"
}