LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50412: drm: bridge: adv7511: unregister cec i2c device after cec adapter

In the Linux kernel, the following vulnerability has been resolved: drm: bridge: adv7511: unregister cec i2c device after cec adapter cec_unregister_adapter() assumes that the underlying adapter ops are callable. For example, if the CEC adapter currently has a valid physical address, then the unregistration procedure will invalidate the physical address by setting it to f.f.f.f. Whence the following kernel oops observed after removing the adv7511 module: Unable to handle kernel execution of user memory at virtual address 0000000000000000 Internal error: Oops: 86000004 [#1] PREEMPT_RT SMP Call trace: 0x0 adv7511_cec_adap_log_addr+0x1ac/0x1c8 [adv7511] cec_adap_unconfigure+0x44/0x90 [cec] __cec_s_phys_addr.part.0+0x68/0x230 [cec] __cec_s_phys_addr+0x40/0x50 [cec] cec_unregister_adapter+0xb4/0x118 [cec] adv7511_remove+0x60/0x90 [adv7511] i2c_device_remove+0x34/0xe0 device_release_driver_internal+0x114/0x1f0 driver_detach+0x54/0xe0 bus_remove_driver+0x60/0xd8 driver_unregister+0x34/0x60 i2c_del_driver+0x2c/0x68 adv7511_exit+0x1c/0x67c [adv7511] __arm64_sys_delete_module+0x154/0x288 invoke_syscall+0x48/0x100 el0_svc_common.constprop.0+0x48/0xe8 do_el0_svc+0x28/0x88 el0_svc+0x1c/0x50 el0t_64_sync_handler+0xa8/0xb0 el0t_64_sync+0x15c/0x160 Code: bad PC value ---[ end trace 0000000000000000 ]--- Protect against this scenario by unregistering i2c_cec after unregistering the CEC adapter. Duly disable the CEC clock afterwards too.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel crash risk in the ADV7511 HDMI bridge driver’s CEC cleanup path. On systems using this hardware and driver, removing the module can trigger a kernel oops. The issue is local, hardware-specific, and most relevant to embedded, media, or ARM platforms rather than typical server fleets.

Executive priority

Prioritize remediation for embedded, appliance, display, or media devices that use ADV7511. For standard cloud or enterprise server fleets, treat as lower operational urgency unless asset inventory shows this driver path is present.

Technical view

The flaw is an unsafe teardown order in drm/bridge/adv7511. cec_unregister_adapter() expects adapter operations to remain callable, but the CEC I2C device could be unregistered first. During adapter unconfiguration, this can lead to a null execution path and kernel oops. The fix unregisters the CEC adapter before the I2C CEC device and disables the CEC clock afterward.

Likely exposure

Exposure is likely limited to Linux systems with the ADV7511 bridge driver and CEC functionality present. Generic Linux servers are unlikely to be exposed unless this driver and hardware path exist. The listed CVSS vector is local, low complexity, low privilege, no user interaction, with high confidentiality, integrity, and availability impact.

Exploitation context

The source bundle does not show CISA KEV listing or public active exploitation. The described trigger is local module removal, shown by a kernel oops trace through sys_delete_module. Evidence for remote exploitation is absent in the provided sources.

Researcher notes

The CVE evidence centers on teardown ordering and a reproduced oops after adv7511 module removal. The source bundle lacks CWE classification, exploit reports, and downstream package status. Validation should focus on kernel source lineage, enabled driver configuration, and vendor backports rather than version strings alone.

Mitigation direction

  • Update to a vendor kernel containing the referenced stable fixes.
  • Check distribution or device-vendor advisories for patched kernel package names.
  • Avoid unloading the adv7511 module on affected systems until patched.
  • Disable unused ADV7511 CEC functionality where vendor-supported.

Validation and detection

  • Inventory systems for ADV7511 hardware, driver availability, and CEC usage.
  • Compare kernel versions against vendor advisories and referenced stable commits.
  • Confirm patched source unregisters the CEC adapter before the I2C CEC device.
  • Review logs for kernel oops traces involving adv7511_remove or cec_unregister_adapter.
Prepared
Confidence
high
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50412 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2022-50412Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux3b1b975003e4a3da4b93ab032487a3ae4afca7b5, 3b1b975003e4a3da4b93ab032487a3ae4afca7b5, 3b1b975003e4a3da4b93ab032487a3ae4afca7b5, 3b1b975003e4a3da4b93ab032487a3ae4afca7b5, 3b1b975003e4a3da4b93ab032487a3ae4afca7b5unaffected
LinuxLinux4.15, 0, 5.10.234, 5.15.75, 5.19.17, 6.0.3, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.