LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50542: media: si470x: Fix use-after-free in si470x_int_in_callback()

In the Linux kernel, the following vulnerability has been resolved: media: si470x: Fix use-after-free in si470x_int_in_callback() syzbot reported use-after-free in si470x_int_in_callback() [1]. This indicates that urb->context, which contains struct si470x_device object, is freed when si470x_int_in_callback() is called. The cause of this issue is that si470x_int_in_callback() is called for freed urb. si470x_usb_driver_probe() calls si470x_start_usb(), which then calls usb_submit_urb() and si470x_start(). If si470x_start_usb() fails, si470x_usb_driver_probe() doesn't kill urb, but it just frees struct si470x_device object, as depicted below: si470x_usb_driver_probe() ... si470x_start_usb() ... usb_submit_urb() retval = si470x_start() return retval if (retval < 0) free struct si470x_device object, but don't kill urb This patch fixes this issue by killing urb when si470x_start_usb() fails and urb is submitted. If si470x_start_usb() fails and urb is not submitted, i.e. submitting usb fails, it just frees struct si470x_device object.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

A bug in a niche Linux driver for Silicon Labs si470x USB FM radio receivers could let the operating system reuse memory it had already freed, potentially crashing the system or, in rare cases, being abused by someone with local or USB access. The Linux kernel project has already published a fix in stable releases. Most enterprises have minimal exposure because this driver is uncommon outside of hobbyist or media setups.

Executive priority

Low priority for most enterprises. Patch via routine kernel updates; treat as urgent only on systems exposing si470x USB radio devices.

Technical view

Use-after-free in the Linux media subsystem driver si470x. When si470x_usb_driver_probe() called si470x_start_usb() and the subsequent si470x_start() failed after usb_submit_urb() had already succeeded, the probe path freed the si470x_device context without killing the in-flight URB. The completion handler si470x_int_in_callback() then dereferenced freed memory. Patch kills the URB on the failure path before freeing the device.

Likely exposure

Linux systems running kernels before 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, or 6.2 that load the si470x USB FM radio driver. Exposure is small because the affected driver targets niche FM tuner USB devices and is rarely enabled in production server builds.

Exploitation context

No public exploit, KEV listing, or in-the-wild activity is cited. The flaw was found by syzbot fuzzing and requires the si470x USB radio driver to load and a probe-time failure path, making practical attack scenarios narrow and largely physical-access dependent.

Researcher notes

Use-after-free in si470x_int_in_callback() caused by si470x_usb_driver_probe() freeing the si470x_device while the submitted URB remained live. Fix kills the URB on the failure path before freeing the context. Trigger requires probe-time failure after usb_submit_urb succeeded, originally surfaced by syzbot. No CVSS, CWE, or KEV entry is provided in the bundle; severity is inferred as low to moderate based on local-only attack surface and driver scope.

Mitigation direction

  • Apply the stable kernel updates listed by kernel.org for your distribution branch.
  • Disable or blacklist the si470x_usb kernel module on hosts that do not need FM radio support.
  • Restrict physical and USB device access on multi-user or kiosk systems.
  • Track distro vendor advisories (RHEL, Debian, Ubuntu, SUSE) for backported fixes.
  • Where patching is delayed, prevent autoload of the radio-si470x-usb module via modprobe.d.

Validation and detection

  • Confirm running kernel version against the fixed releases listed (4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, 6.2+).
  • Check whether the radio-si470x-usb module is built or loaded using lsmod and modinfo.
  • Inventory hosts with attached or historical FM radio USB peripherals.
  • Review distribution security trackers for backport status of this CVE.
  • After patching, verify the updated kernel boots cleanly and the module loads without regression.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50542 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
10Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux779471110c6f0f7f7c223fc696170ec750ac3531, 779471110c6f0f7f7c223fc696170ec750ac3531, 779471110c6f0f7f7c223fc696170ec750ac3531, 779471110c6f0f7f7c223fc696170ec750ac3531, 779471110c6f0f7f7c223fc696170ec750ac3531, 779471110c6f0f7f7c223fc696170ec750ac3531, 779471110c6f0f7f7c223fc696170ec750ac3531, 779471110c6f0f7f7c223fc696170ec750ac3531, 779471110c6f0f7f7c223fc696170ec750ac3531unaffected
LinuxLinux3.6, 0, 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, 6.2affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.