CVE-2022-50115: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a vulnerability was discovered related to double freeing of ipccontroldata via loadbytes in the ASoC SOF ipc3-topology component. The issue was assigned CVE-2022-50115 and was published on June 18, 2025. The vulnerability occurs when sanity checks for byte controls fail, causing the locally allocated scontrol->ipccontroldata to be freed but not set to NULL. On a rollback path of the error, the higher level code attempts to free scontrol->ipccontrol_data again, leading to a double-free condition (NVD, Wiz).

The vulnerability stems from a memory management issue in the Linux kernel's ASoC SOF ipc3-topology component. When sanity checks for byte controls fail, the locally allocated scontrol->ipccontroldata is freed, but the pointer is not set to NULL. Subsequently, on the error rollback path, the higher-level code attempts to free the same memory location again, resulting in a double-free condition that can lead to memory corruption (NVD).

This vulnerability can lead to memory corruption in the Linux kernel due to the double freeing of memory, which could potentially result in system instability or security issues (Wiz).

The vulnerability has been resolved in the Linux kernel through a patch that prevents the double freeing of ipccontroldata in the ASoC SOF ipc3-topology component (NVD).