CVE-2022-50725: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-50725 is a use-after-free vulnerability in the Linux kernel's media/vidtv subsystem, specifically within the vidtv_bridge_dvb_init() function. The flaw arises from incorrect error handling during DVB bridge initialization, where cleanup functions are called twice on already-freed memory. It affects Linux kernel versions from 5.10 through stable branches prior to 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. The vulnerability was published on December 24, 2025, and is estimated as Medium severity by Feedly; no official CVSS score has been assigned at this time (Feedly, ENISA EUVD).

The root cause is a use-after-free (CWE-416) in vidtv_bridge_dvb_init() within the Linux kernel's virtual DVB test driver (drivers/media/test-drivers/vidtv). When initialization of vidtv_bridge_dmx or vidtv_bridge_dmxdev fails, those functions perform their own internal cleanup; however, the error-handling goto labels (fail_dmx, fail_dmx_dev) then call release functions a second time on already-freed memory, triggering the use-after-free. Additionally, in the fail_fe, fail_tuner_probe, and fail_demod_probe error paths, the assignment j = i when i == NUM_FE causes a potential out-of-bounds access. KASAN (Kernel Address Sanitizer) detects the bug as a use-after-free in dvb_dmxdev_release+0x4d5/0x5d0 [dvb_core] during vidtv_bridge_probe (Feedly).

Exploitation of this vulnerability could lead to kernel memory corruption due to the use-after-free condition, potentially resulting in a system crash (denial of service) or, in more severe scenarios, privilege escalation if an attacker can control the freed memory region. The affected component is the virtual DVB test driver (dvb_vidtv_bridge), which is typically used in testing environments and may not be loaded by default on production systems, limiting the practical attack surface. Confidentiality and integrity impacts depend on whether an attacker can leverage the freed memory for further exploitation (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50725. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The affected module (dvb_vidtv_bridge) is a virtual test driver unlikely to be enabled on most production Linux systems, further reducing exploitability (Feedly).

The Linux kernel stable team has released fixes across multiple stable branches. Users should update to the following patched versions or later: Linux 5.10.163, 5.15.86, 6.0.16, 6.1.2, or 6.2. The fix corrects the error-handling logic in vidtv_bridge_dvb_init() to ensure resources are released exactly once and loop bounds are correct. As a workaround, systems that do not require the virtual DVB test driver can unload or blacklist the dvb_vidtv_bridge kernel module to eliminate exposure (ENISA EUVD, Kernel Commit).