CVE-2022-50369: drm/vkms: Fix null-ptr-deref in vkms_release()
Vulnerability summary
CVE-2022-50369 is a medium (CVSS 5.5) NULL Pointer Dereference vulnerability in linux. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 10.1% of scored vulnerabilities.
Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 10 · Related 4Timeline
- 17-09-2025PublishedVulnerability first disclosed.
- 11-05-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Fix null-ptr-deref in vkms_release() A null-ptr-deref is triggered when it tries to destroy the workqueue in vkms->output.composer_workq in vkms_release(). KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] CPU: 5 PID: 17193 Comm: modprobe Not tainted 6.0.0-11331-gd465bff130bf #24 RIP: 0010:destroy_workqueue+0x2f/0x710 ... Call Trace: <TASK> ? vkms_config_debugfs_init+0x50/0x50 [vkms] __devm_drm_dev_alloc+0x15a/0x1c0 [drm] vkms_init+0x245/0x1000 [vkms] do_one_initcall+0xd0/0x4f0 do_init_module+0x1a4/0x680 load_module+0x6249/0x7110 __do_sys_finit_module+0x140/0x200 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The reason is that an OOM happened which triggers the destroy of the workqueue, however, the workqueue is alloced in the later process, thus a null-ptr-deref happened. A simple call graph is shown as below: vkms_init() vkms_create() devm_drm_dev_alloc() __devm_drm_dev_alloc() devm_drm_dev_init() devm_add_action_or_reset() devm_add_action() # an error happened devm_drm_dev_init_release() drm_dev_put() kref_put() drm_dev_release() vkms_release() destroy_workqueue() # null-ptr-deref happened vkms_modeset_init() vkms_output_init() vkms_crtc_init() # where the workqueue get allocated Fix this by checking if composer_workq is NULL before passing it to the destroy_workqueue() in vkms_release().
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.20%
Chance of exploitation in the next 30 days
Percentile
10%
Versus all other CVEs
30-day change
Increase +0.01 pp
From 0.20% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu117 products
- linuxAll versions (No fix recorded) | < 5.15.0-75.82
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1038.43
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 6c234fe37c57627a5baf96f552afa1fae2b67d4d, < 0b8f390e2251191f1b179cc87f65d54c96565f0d | ≥ 6c234fe37c57627a5baf96f552afa1fae2b67d4d, < 1f9836f95271e7acf016667eee0aeae3386f9645 | ≥ 6c234fe37c57627a5baf96f552afa1fae2b67d4d, < 596f1ba3987e601e31a5abf1f75ce1d2635aceac | ≥ 6c234fe37c57627a5baf96f552afa1fae2b67d4d, < 57031c474c3a920ea73afeb5dc352e537f5793ee | ≥ 6c234fe37c57627a5baf96f552afa1fae2b67d4d, < 2fe2a8f40c21161ffe7653cc234e7934db5b7cc5 | 4.20
- linux_kernel≥ 4.20, < 5.10.173 | ≥ 5.11, < 5.15.99 | ≥ 5.16, < 6.1.16 | ≥ 6.2, < 6.2.3
Debian1 product
- linux< 6.1.20-1
3 vendors · 120 products
