CVE-2022-50499: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50499 is a vulnerability discovered in the Linux kernel's DVB-core subsystem, specifically in the dvb_register_device() function. The vulnerability was disclosed on October 4, 2025, affecting the media subsystem of the Linux kernel (NVD).

The vulnerability occurs in the function chain dvb_register_device() -> dvb_register_media_device() -> dvb_create_media_entity(), where dvb->entity is allocated and initialized. When initialization fails, the code frees dvb->entity and returns an error code. However, the caller handles the error by calling dvb_media_device_free(), which attempts to free the field again if it's not NULL. Since dvb->entity may not be NULLed in dvb_create_media_entity() when the allocation of dvbdev->pad fails, this can result in a double free condition (RedHat).

The vulnerability can lead to a double free condition and potentially cause a Use-After-Free situation in media_device_unregister_entity(). This could result in system instability or potential privilege escalation (NVD).

The vulnerability requires local access with low privileges to exploit. It has been assigned a CVSS v3.1 base score of 5.5, indicating moderate severity (RedHat).

The issue has been fixed by modifying the code to store NULL to dvb->entity when it is freed. Multiple Linux distributions have released patches, including Ubuntu which has fixed the vulnerability in various kernel versions including 5.15.0-69.76 for 22.04 LTS and 5.4.0-144.161 for 20.04 LTS (Ubuntu).