Security readout for executives and security teams
Plain-English summary
CVE-2022-50229 is a Linux kernel bug in the ALSA bcd2000 driver. If device probing fails at a specific registration step, the driver can free a USB request before stopping it, creating a use-after-free condition. The public sources do not show active exploitation or a CVSS score.
Executive priority
Treat this as a targeted Linux kernel maintenance item, not an emergency. Patch through normal kernel update channels, with higher priority for workstations, labs, kiosks, or servers where untrusted USB devices may be attached.
Technical view
The issue occurs on the probe error path when snd_card_register() fails. The driver frees bcd2k->midi_out_urb before killing it, and KASAN showed use-after-free in bcd2000_input_complete. The upstream fix adds usb_kill_urb() before usb_free_urb().
Likely exposure
Exposure appears limited to Linux systems running affected kernels with the ALSA bcd2000 driver reachable during device probing. The provided data names Linux kernel versions and stable commits, but does not define distributions, default module loading, or remote reachability.
Exploitation context
The bundle does not cite known exploitation, and KEV is false. The described trigger is a driver probe failure path, suggesting local hardware or USB-adjacent exposure rather than a general remote service risk. Evidence is incomplete on practical exploitability.
Researcher notes
The strongest evidence is the upstream kernel description and stable commit references. Severity, CVSS, CWE, exploitability, and distribution impact are not provided. Avoid claiming privilege escalation, code execution, or active exploitation without additional vendor or researcher evidence.
Mitigation direction
- Update to a kernel build containing the relevant stable bcd2000 fix commit.
- Check Linux distribution advisories for backported fixes in supported kernel packages.
- Prioritize systems where untrusted USB devices can be attached.
- If updates are delayed, follow vendor guidance for reducing bcd2000 driver exposure.
Validation and detection
- Inventory Linux kernel versions against the affected version list in the CVE record.
- Confirm distro kernel changelogs include the bcd2000 usb_kill_urb before usb_free_urb fix.
- Check whether the snd_bcd2000 driver is present or loadable on exposed systems.
- Review fleet policy for systems allowing untrusted USB device attachment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50229 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a718eba7e458e2f40531be3c6b6a0028ca7fcaceCVE reference, Linux
- https://git.kernel.org/stable/c/4fc41f7ebb7efca282f1740ea934d16f33c1d109CVE reference, Linux
- https://git.kernel.org/stable/c/5e7338f4dd92b2f8915a82abfa1dd3ad3464bea0CVE reference, Linux
- https://git.kernel.org/stable/c/05e0bb8c3c4dde3e21b9c1cf9395afb04e8b24dbCVE reference, Linux
- https://git.kernel.org/stable/c/348620464a5c127399ac09b266f494f393661952CVE reference, Linux
- https://git.kernel.org/stable/c/64ca7f50ad96c2c65ae390b954925a36eabe04aaCVE reference, Linux
- https://git.kernel.org/stable/c/1d6a246cf97c380f2da76591f03019dd9c9599c3CVE reference, Linux
- https://git.kernel.org/stable/c/b0d4af0a4763ddc02344789ef2a281c494bc330dCVE reference, Linux
- https://git.kernel.org/stable/c/ffb2759df7efbc00187bfd9d1072434a13a54139CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.