ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()

Description

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() There is an use-after-free reported by KASAN: BUG: KASAN: use-after-free in acpi_ut_remove_reference+0x3b/0x82 Read of size 1 at addr ffff888112afc460 by task modprobe/2111 CPU: 0 PID: 2111 Comm: modprobe Not tainted 6.1.0-rc7-dirty Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), Call Trace: <TASK> kasan_report+0xae/0xe0 acpi_ut_remove_reference+0x3b/0x82 acpi_ut_copy_iobject_to_iobject+0x3be/0x3d5 acpi_ds_store_object_to_local+0x15d/0x3a0 acpi_ex_store+0x78d/0x7fd acpi_ex_opcode_1A_1T_1R+0xbe4/0xf9b acpi_ps_parse_aml+0x217/0x8d5 ... </TASK> The root cause of the problem is that the acpi_operand_object is freed when acpi_ut_walk_package_tree() fails in acpi_ut_copy_ipackage_to_ipackage(), lead to repeated release in acpi_ut_copy_iobject_to_iobject(). The problem was introduced by "8aa5e56eeb61" commit, this commit is to fix memory leak in acpi_ut_copy_iobject_to_iobject(), repeatedly adding remove operation, lead to "acpi_operand_object" used after free. Fix it by removing acpi_ut_remove_reference() in acpi_ut_copy_ipackage_to_ipackage(). acpi_ut_copy_ipackage_to_ipackage() is called to copy an internal package object into another internal package object, when it fails, the memory of acpi_operand_object should be freed by the caller.

Scores

EPSS (exploitation in 30 days)

0.17% · top 94% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Weakness

• CWE-416 Use After Free (opens in a new tab)All about CWE-416 and its CVEs

Affected products

• Linux · Linux

  • affected 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce – < 133462d35dae95edb944af86b986d4c9dec59bd1
  • affected 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce – < 02f237423c9c6a18e062de2d474f85d5659e4eb9
  • affected 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce – < c9125b643fc51b8e662f2f614096ceb45a0adbc3
  • affected 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce – < dfdde4d5138bc023897033a5ac653a84e94805be
  • affected 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce – < 02617006b5a46f2ea55ac61f5693c7afd7bf9276
  • affected 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce – < 6fde666278f91b85d71545a0ebbf41d8d7af8074
  • affected 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce – < f51b2235e4f320edc839c3e5cb0d1f8a6e8657c6
  • affected 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce – < 01f2c2052ea50fb9a8ce12e4e83aed0267934ef0
  • affected 8aa5e56eeb61a099ea6519eb30ee399e1bc043ce – < 470188b09e92d83c5a997f25f0e8fb8cd2bc3469
  • affected b3e98f0c4f996cd53b80bad71f0d7e4a2cf3a4e8
  • affected 7af5504c102a378376101dbd160246b10a814dd0
  • affected e29a15484d7ea949e49ae7fb7e576a575da824a6
  • affected e2ab6731a36966d042a2d4dabd980496cd680f75
  • affected 3.10.55 – < 3.11
  • affected 3.12.29 – < 3.13
  • affected 3.14.19 – < 3.15
  • affected 3.16.3 – < 3.17

• Linux · Linux

  • affected 3.17
  • unaffected < 3.17
  • unaffected 4.9.337 – ≤ 4.9.*
  • unaffected 4.14.303 – ≤ 4.14.*
  • unaffected 4.19.270 – ≤ 4.19.*
  • unaffected 5.4.229 – ≤ 5.4.*
  • unaffected 5.10.163 – ≤ 5.10.*
  • unaffected 5.15.86 – ≤ 5.15.*
  • unaffected 6.0.16 – ≤ 6.0.*
  • unaffected 6.1.2 – ≤ 6.1.*
  • unaffected 6.2 – ≤ *

References (9)

• https://git.kernel.org/stable/c/133462d35dae95edb944af86b986d4c9dec59bd1 (opens in a new tab)
• https://git.kernel.org/stable/c/02f237423c9c6a18e062de2d474f85d5659e4eb9 (opens in a new tab)
• https://git.kernel.org/stable/c/c9125b643fc51b8e662f2f614096ceb45a0adbc3 (opens in a new tab)
• https://git.kernel.org/stable/c/dfdde4d5138bc023897033a5ac653a84e94805be (opens in a new tab)
• https://git.kernel.org/stable/c/02617006b5a46f2ea55ac61f5693c7afd7bf9276 (opens in a new tab)
• https://git.kernel.org/stable/c/6fde666278f91b85d71545a0ebbf41d8d7af8074 (opens in a new tab)
• https://git.kernel.org/stable/c/f51b2235e4f320edc839c3e5cb0d1f8a6e8657c6 (opens in a new tab)
• https://git.kernel.org/stable/c/01f2c2052ea50fb9a8ce12e4e83aed0267934ef0 (opens in a new tab)
• https://git.kernel.org/stable/c/470188b09e92d83c5a997f25f0e8fb8cd2bc3469 (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2022-50423](https://trackcve.app/badge/CVE-2022-50423.svg)](https://trackcve.app/cve/CVE-2022-50423)

Record last updated 5 Aug 2026, 08:58 UTC.