In the Linux kernel, the following vulnerability has been resolved:
media: dvb-core: Fix double free in dvbregisterdevice()
In function dvbregisterdevice() -> dvbregistermediadevice() -> dvbcreatemediaentity(), dvb->entity is allocated and initialized. If the initialization fails, it frees the dvb->entity, and return an error code. The caller takes the error code and handles the error by calling dvbmediadevicefree(), which unregisters the entity and frees the field again if it is not NULL. As dvb->entity may not NULLed in dvbcreatemediaentity() when the allocation of dvbdev->pad fails, a double free may occur. This may also cause an Use After free in mediadeviceunregister_entity().
Fix this by storing NULL to dvb->entity when it is freed.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50499.json"
}