CVE-2022-50305 - CVE House
Back to Database
Status published High CVE-2022-50305

ASoC: sof_es8336: fix possible use-after-free in sof_es8336_remove()

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: ASoC: sof_es8336: fix possible use-after-free in sof_es8336_remove() sof_es8336_remove() calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling cancel_delayed_work_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedule itself.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-50305

Credits & Attribution

No credits recorded in the NVD database.

Affected Vendor

Affected Software

Linux
Vulnerable Versions:
b60ee210a76cabdc2dd5396de299a1860b4945cd, 89cdb224f2abe37ec4ac21ba0d9ddeb5a6a9cf68, 6.0.11, 6.1, 0, 6.0.16, 6.1.2, 6.2

Timeline

Official Publish: September 15th, 2025
Last Modified: May 23rd, 2026
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.