CVE-2022-50305

Source
https://nvd.nist.gov/vuln/detail/CVE-2022-50305
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-50305.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-50305
Downstream
Published
2025-09-15T14:46:00.558Z
Modified
2025-11-29T08:13:57.871733Z
Summary
ASoC: sof_es8336: fix possible use-after-free in sof_es8336_remove()
Details

In the Linux kernel, the following vulnerability has been resolved:

ASoC: sofes8336: fix possible use-after-free in sofes8336_remove()

sofes8336remove() calls canceldelayedwork(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function has finished, which would result in a use-after-free.

Fix by calling canceldelayedwork_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedule itself.

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50305.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
b60ee210a76cabdc2dd5396de299a1860b4945cd
Fixed
b85102a3aa3810a09eb55692e8cd6ffbb304e57d
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
89cdb224f2abe37ec4ac21ba0d9ddeb5a6a9cf68
Fixed
390a1a98288a53b2e7555097d83c6e55d579b166
Fixed
1b41beaa7a58467505ec3023af8aad74f878b888

Affected versions

v6.*

v6.0.11
v6.0.12
v6.0.13
v6.0.14
v6.0.15
v6.1
v6.1-rc2
v6.1-rc3
v6.1-rc4
v6.1-rc5
v6.1-rc6
v6.1-rc7
v6.1-rc8
v6.1.1

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.0.16
Type
ECOSYSTEM
Events
Introduced
6.1.0
Fixed
6.1.2