What is CVE-2022-50411?

CVE-2022-50411 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10, classified as a Use After Free flaw (CWE-416), affecting Linux kernel versions from 2.6.12 onward and patched in 4.9.337, 4.14.303, 4.19.270 and others. CVE-2022-50411 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2022-50411?

CVE-2022-50411 has a CVSS score of 7.8 out of 10, rated High severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Is there a patch available for CVE-2022-50411?

Yes, CVE-2022-50411 has been patched. Fixed versions include 4.9.337, 4.14.303, 4.19.270 and others. If you are running Linux kernel 2.6.12 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2022-50411 actively exploited?

CVE-2022-50411 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is Use After Free (CWE-416)?

The product references memory after it has been freed, which may cause it to crash, use unexpected values, or execute code. See MITRE CWE for full details: https://cwe.mitre.org/data/definitions/416.html

CVE-2022-50411

High

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix error code path in acpi_ds_call_control_method() A use-after-free in acpi_ps_parse_aml() after a failing invocaion of acpi_ds_call_control_method() is reported by KASAN [1] and code inspection reveals that next_walk_state pushed to the thread by acpi_ds_create_walk_state() is freed on errors, but it is not popped from the thread beforehand. Thus acpi_ds_get_current_walk_state() called by acpi_ps_parse_aml() subsequently returns it as the new walk state which is incorrect. To address this, make acpi_ds_call_control_method() call acpi_ds_pop_walk_state() to pop next_walk_state from the thread before returning an error.

Package Linux Kernel

Published 2025-09-18

Last modified 2026-01-14

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

7.8

out of 10

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness type

CWE-416

CVE-2022-50411 is a Use After Free vulnerability

What is Use After Free?

The product references memory after it has been freed, which may cause it to crash, use unexpected values, or execute code. Learn more on MITRE CWE

Affected versions

Linux kernel versions 2.6.12 and later are affected. Fixed in 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, 6.2 and their respective stable series.

Affected from

≥ 2.6.12

Fixed in

✓ 4.9.337 4.9.x ✓ 4.14.303 4.14.x ✓ 4.19.270 4.19.x ✓ 5.4.229 5.4.x ✓ 5.10.163 5.10.x ✓ 5.15.86 5.15.x ✓ 6.0.16 6.0.x ✓ 6.1.2 6.1.x ✓ 6.2

References

9 total

Kernel Git
https://git.kernel.org/stable/c/0462fec709d51762ba486245bc344f44cc6cfa97

Patch
Kernel Git
https://git.kernel.org/stable/c/2deb42c4f9776e59bee247c14af9c5e8c05ca9a6

Patch
Kernel Git
https://git.kernel.org/stable/c/38e251d356a01b61a86cb35213cafd7e8fe7090c

Patch
Kernel Git
https://git.kernel.org/stable/c/404ec60438add1afadaffaed34bb5fe4ddcadd40

Patch
Kernel Git
https://git.kernel.org/stable/c/5777432ebaaf797e24f059979b42df3139967163

Patch

Showing 5 of 9 references View all on NVD

Details

CVE ID CVE-2022-50411

Severity High

CVSS score 7.8 / 10

CVSS version 3.1

Published 2025-09-18

Modified 2026-01-14

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2022-50411?

CVE-2022-50411 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10 , classified as an Use After Free flaw (CWE-416) . It affects Linux kernel versions from 2.6.12 onward and has been patched in 4.9.337, 4.14.303, 4.19.270 and others. CVE-2022-50411 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2022-50411?

CVE-2022-50411 has a CVSS score of 7.8 out of 10, rated High severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Is there a patch available for CVE-2022-50411?

Yes. CVE-2022-50411 has been patched. Fixed versions include 4.9.337, 4.14.303, 4.19.270 and others. If you are running Linux kernel 2.6.12 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2022-50411 actively exploited?

No. CVE-2022-50411 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.