CVE-2022-50499: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50499 is a vulnerability discovered in the Linux kernel's DVB-core subsystem, specifically in the dvbregisterdevice() function. The vulnerability was disclosed on October 4, 2025, affecting the media subsystem of the Linux kernel (NVD).

The vulnerability occurs in the function chain dvbregisterdevice() -> dvbregistermediadevice() -> dvbcreatemediaentity(), where dvb->entity is allocated and initialized. When initialization fails, the code frees dvb->entity and returns an error code. However, the caller handles the error by calling dvbmediadevicefree(), which attempts to free the field again if it's not NULL. Since dvb->entity may not be NULLed in dvbcreatemediaentity() when the allocation of dvbdev->pad fails, this can result in a double free condition (RedHat).

The vulnerability can lead to a double free condition and potentially cause a Use-After-Free situation in mediadeviceunregister_entity(). This could result in system instability or potential privilege escalation (NVD).

The issue has been fixed by modifying the code to store NULL to dvb->entity when it is freed. Multiple Linux distributions have released patches, including Ubuntu which has fixed the vulnerability in various kernel versions including 5.15.0-69.76 for 22.04 LTS and 5.4.0-144.161 for 20.04 LTS (Ubuntu).