CVE-2022-50423: ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• linux linux kernel3.10.55 and later · before 3.11
• linux linux kernel3.12.29 and later · before 3.13
• linux linux kernel3.14.19 and later · before 3.15
• linux linux kernel3.16.3 and later · before 4.9.337
• linux linux kernel4.10 and later · before 4.14.303
• linux linux kernel4.15 and later · before 4.19.270
• linux linux kernel4.20 and later · before 5.4.229
• linux linux kernel5.5 and later · before 5.10.163
• linux linux kernel5.11 and later · before 5.15.86
• linux linux kernel5.16 and later · before 6.0.16
• linux linux kernel6.1 and later · before 6.1.2

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • b3e98f0c4f996cd53b80bad71f0d7e4a2cf3a4e8, 7af5504c102a378376101dbd160246b10a814dd0, e29a15484d7ea949e49ae7fb7e576a575da824a6, e2ab6731a36966d042a2d4dabd980496cd680f75, 3.17affected
  • 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce and later · before 133462d35dae95edb944af86b986d4c9dec59bd1affected · git
  • 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce and later · before 02f237423c9c6a18e062de2d474f85d5659e4eb9affected · git
  • 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce and later · before c9125b643fc51b8e662f2f614096ceb45a0adbc3affected · git
  • 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce and later · before dfdde4d5138bc023897033a5ac653a84e94805beaffected · git
  • 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce and later · before 02617006b5a46f2ea55ac61f5693c7afd7bf9276affected · git
  • 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce and later · before 6fde666278f91b85d71545a0ebbf41d8d7af8074affected · git
  • 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce and later · before f51b2235e4f320edc839c3e5cb0d1f8a6e8657c6affected · git
  • 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce and later · before 01f2c2052ea50fb9a8ce12e4e83aed0267934ef0affected · git
  • 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce and later · before 470188b09e92d83c5a997f25f0e8fb8cd2bc3469affected · git

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV
  90Now
• CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe KEV
  89Now
• CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV
  85Now

Published before and after this one in the same product

• ← EarlierCVE-2022-50422Oct 1, 2025 · scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()
  31Monitor
• ← EarlierCVE-2025-39907Oct 1, 2025 · mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer
  22Monitor
• Later →CVE-2025-39908Oct 1, 2025 · net: dev_ioctl: take ops lock in hwtstamp lower paths
  22Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.