Security readout for executives and security teams
Plain-English summary
CVE-2022-50560 is a Linux kernel bug in the Meson DRM display driver path. Unloading and reloading related display modules can leave stale kernel objects and trigger a use-after-free crash condition. Exposure appears limited to systems using this hardware driver path and permitting module unload/reload activity.
Executive priority
Treat as a targeted Linux kernel maintenance issue, not an internet-wide emergency. Prioritize patching where Meson display drivers are present, especially embedded products with field update constraints or environments allowing privileged local administration.
Technical view
The meson_drm module did not call component_master_del during unload, leaving an aggregate device in the global aggregate_devices list. Reloading meson_dw_hdmi could then dereference freed devres-managed memory in find_components, producing a KASAN use-after-free. Kernel stable commits are referenced as the resolution.
Likely exposure
Most relevant to Linux systems using Amlogic Meson DRM/HDMI drivers, especially embedded ARM devices. The described trigger involves module unload and reload operations, which typically require elevated local privileges. Systems not using this driver path are unlikely to be exposed.
Exploitation context
The provided sources do not show active exploitation, and this CVE is not marked KEV. The public description demonstrates a kernel use-after-free during modprobe-driven driver reload behavior, not a remote attack path.
Researcher notes
The root issue is stale aggregate device state after meson_drm unload. The fix direction is explicit aggregate driver removal at module unload. Public data lacks CVSS, CWE mapping, and confirmed exploitability beyond the described KASAN-triggered use-after-free scenario.
Mitigation direction
- Update to a kernel or vendor package containing the referenced stable fixes.
- Check distribution advisories for backported fixes before relying on version numbers alone.
- Avoid unnecessary unload/reload of meson_drm and meson_dw_hdmi modules where operationally possible.
- Prioritize affected embedded or appliance systems using Amlogic Meson display hardware.
Validation and detection
- Inventory Linux systems using Meson DRM or meson_dw_hdmi modules.
- Compare running kernel packages against vendor advisories or referenced stable commits.
- Review kernel logs for KASAN use-after-free reports involving find_components or Meson DRM.
- Confirm whether module unloading is permitted in production configurations.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50560 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8a427a22839daacd36531a62c83d5c9cd6f20657CVE reference, Linux
- https://git.kernel.org/stable/c/587c7da877219e6185217bf64418e62e114dab1eCVE reference, Linux
- https://git.kernel.org/stable/c/f11aa996fc01888f870be0e79ba71526888c0d8aCVE reference, Linux
- https://git.kernel.org/stable/c/6ef20de2fe0ee1decedbfabb17782897ca27bfe5CVE reference, Linux
- https://git.kernel.org/stable/c/8616f2a0589a80e08434212324250eb22f6a66ceCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.