CVE-2022-50005: 
Linux Kernel vulnerability analysis and mitigation

A use-after-free vulnerability (CVE-2022-50005) was discovered in the Linux kernel's NFC subsystem, specifically in the pn533 driver. The vulnerability was identified when the pn532 uart device is detaching, where the pn532uartremove() function is called but fails to delete the cmd_timeout timer (NVD, Wiz).

The vulnerability occurs due to a race condition between two threads. Thread 1 executes pn532uartsendframe and sets up a timer with modtimer(&pn532->cmdtimeout,...), while thread 2 executes pn532uartremove and frees the pn532 structure without first deleting the timer. This leads to a use-after-free scenario when the timer callback pn532cmd_timeout attempts to access the freed pn532 structure (NVD).

If successfully exploited, this vulnerability could lead to a system crash (denial of service) or potentially allow arbitrary code execution due to the use-after-free condition in the kernel's NFC subsystem (Wiz).

The vulnerability has been patched by adding deltimersync() in pn532uartremove() to properly delete the timer before freeing resources. Additionally, the fix ensures that pn53xunregisternfc() is well synchronized by setting nfcdev->shuttingdown to true, preventing any syscalls from restarting the cmd_timeout timer (NVD).