In the Linux kernel, the following vulnerability has been resolved:
rpmsg: char: Avoid double destroy of default endpoint
The rpmsg_dev_remove() in rpmsg_core is the place for releasing
this default endpoint.
So need to avoid destroying the default endpoint in
rpmsg_chrdev_eptdev_destroy(), this should be the same as
rpmsg_eptdev_release(). Otherwise there will be double destroy
issue that ept->refcount report warning:
refcount_t: underflow; use-after-free.
Call trace:
refcount_warn_saturate+0xf8/0x150
virtio_rpmsg_destroy_ept+0xd4/0xec
rpmsg_dev_remove+0x60/0x70
The issue can be reproduced by stopping remoteproc before
closing the /dev/rpmsgX.
References
Configurations
Configuration 1 (hide)
|
History
11 Dec 2025, 18:24
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/3f20ef7a845c2c8d7ec82ecffa20d95cab5ecfeb - Patch | |
| References | () https://git.kernel.org/stable/c/467233a4ac29b215d492843d067a9f091e6bf0c5 - Patch | |
| References | () https://git.kernel.org/stable/c/ef828a39d6a7028836eaf37df3ad568c8c2dd6f9 - Patch | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| CWE | CWE-416 | |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| First Time |
Linux
Linux linux Kernel |
01 Oct 2025, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-01 12:15
Updated : 2025-12-11 18:24
NVD link : CVE-2022-50421
Mitre link : CVE-2022-50421
CVE.ORG link : CVE-2022-50421
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free