{"id":"CVE-2022-50556","state":"PUBLISHED","title":"drm: Fix potential null-ptr-deref due to drmm_mode_config_init()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: Fix potential null-ptr-deref due to drmm_mode_config_init()\n\ndrmm_mode_config_init() will call drm_mode_create_standard_properties()\nand won't check the ret value. When drm_mode_create_standard_properties()\nfailed due to alloc, property will be a NULL pointer and may causes the\nnull-ptr-deref. Fix the null-ptr-deref by adding the ret value check.\n\nFound null-ptr-deref while testing insert module bochs:\ngeneral protection fault, probably for non-canonical address\n    0xdffffc000000000c: 0000 [#1] SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]\nCPU: 3 PID: 249 Comm: modprobe Not tainted 6.1.0-rc1+ #364\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\nrel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014\nRIP: 0010:drm_object_attach_property+0x73/0x3c0 [drm]\nCall Trace:\n <TASK>\n __drm_connector_init+0xb6c/0x1100 [drm]\n bochs_pci_probe.cold.11+0x4cb/0x7fe [bochs]\n pci_device_probe+0x17d/0x340\n really_probe+0x1db/0x5d0\n __driver_probe_device+0x1e7/0x250\n driver_probe_device+0x4a/0x120\n __driver_attach+0xcd/0x2c0\n bus_for_each_dev+0x11a/0x1b0\n bus_add_driver+0x3d7/0x500\n driver_register+0x18e/0x320\n do_one_initcall+0xc4/0x3e0\n do_init_module+0x1b4/0x630\n load_module+0x5dca/0x7230\n __do_sys_finit_module+0x100/0x170\n do_syscall_64+0x3f/0x90\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x7ff65af9f839","publishedAt":"2025-10-22T13:23:17.527Z","updatedAt":"2026-05-11T19:21:42.566Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"6b4959f43a04e12d39c5700607727f2cbcfeac31","status":"affected","lessThan":"5ae70041a6d7de62a0cdb2bbcfe0c9cf753035d0","versionType":"git"},{"version":"6b4959f43a04e12d39c5700607727f2cbcfeac31","status":"affected","lessThan":"d06e827a65a6bcd2e329045d891d0739cec1cf4a","versionType":"git"},{"version":"6b4959f43a04e12d39c5700607727f2cbcfeac31","status":"affected","lessThan":"b14147464251f66e38fa39f0aae9780466db8610","versionType":"git"},{"version":"6b4959f43a04e12d39c5700607727f2cbcfeac31","status":"affected","lessThan":"961620ad67611a7320a49f4b6f3c5e2906833a03","versionType":"git"},{"version":"6b4959f43a04e12d39c5700607727f2cbcfeac31","status":"affected","lessThan":"834c23e4f798dcdc8af251b3c428ceef94741991","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/drm_mode_config.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.0","versionType":"semver"},{"version":"5.10.173","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.99","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.16","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.2.3","status":"unaffected","lessThanOrEqual":"6.2.*","versionType":"semver"},{"version":"6.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/drm_mode_config.c"]}],"references":["https://git.kernel.org/stable/c/5ae70041a6d7de62a0cdb2bbcfe0c9cf753035d0","https://git.kernel.org/stable/c/d06e827a65a6bcd2e329045d891d0739cec1cf4a","https://git.kernel.org/stable/c/b14147464251f66e38fa39f0aae9780466db8610","https://git.kernel.org/stable/c/961620ad67611a7320a49f4b6f3c5e2906833a03","https://git.kernel.org/stable/c/834c23e4f798dcdc8af251b3c428ceef94741991"],"weaknesses":[],"ingestedAt":"2026-10-29T20:05:26.763Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/50xxx/CVE-2022-50556.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-50556","state":"PUBLISHED","datePublished":"2025-10-22T13:23:17.527Z","dateUpdated":"2026-05-11T19:21:42.566Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-10-22T13:20:23.758Z"},"containers":{"cna":{"title":"drm: Fix potential null-ptr-deref due to drmm_mode_config_init()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: Fix potential null-ptr-deref due to drmm_mode_config_init()\n\ndrmm_mode_config_init() will call drm_mode_create_standard_properties()\nand won't check the ret value. When drm_mode_create_standard_properties()\nfailed due to alloc, property will be a NULL pointer and may causes the\nnull-ptr-deref. Fix the null-ptr-deref by adding the ret value check.\n\nFound null-ptr-deref while testing insert module bochs:\ngeneral protection fault, probably for non-canonical address\n    0xdffffc000000000c: 0000 [#1] SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]\nCPU: 3 PID: 249 Comm: modprobe Not tainted 6.1.0-rc1+ #364\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\nrel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014\nRIP: 0010:drm_object_attach_property+0x73/0x3c0 [drm]\nCall Trace:\n <TASK>\n __drm_connector_init+0xb6c/0x1100 [drm]\n bochs_pci_probe.cold.11+0x4cb/0x7fe [bochs]\n pci_device_probe+0x17d/0x340\n really_probe+0x1db/0x5d0\n __driver_probe_device+0x1e7/0x250\n driver_probe_device+0x4a/0x120\n __driver_attach+0xcd/0x2c0\n bus_for_each_dev+0x11a/0x1b0\n bus_add_driver+0x3d7/0x500\n driver_register+0x18e/0x320\n do_one_initcall+0xc4/0x3e0\n do_init_module+0x1b4/0x630\n load_module+0x5dca/0x7230\n __do_sys_finit_module+0x100/0x170\n do_syscall_64+0x3f/0x90\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\nRIP: 0033:0x7ff65af9f839"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"6b4959f43a04e12d39c5700607727f2cbcfeac31","status":"affected","lessThan":"5ae70041a6d7de62a0cdb2bbcfe0c9cf753035d0","versionType":"git"},{"version":"6b4959f43a04e12d39c5700607727f2cbcfeac31","status":"affected","lessThan":"d06e827a65a6bcd2e329045d891d0739cec1cf4a","versionType":"git"},{"version":"6b4959f43a04e12d39c5700607727f2cbcfeac31","status":"affected","lessThan":"b14147464251f66e38fa39f0aae9780466db8610","versionType":"git"},{"version":"6b4959f43a04e12d39c5700607727f2cbcfeac31","status":"affected","lessThan":"961620ad67611a7320a49f4b6f3c5e2906833a03","versionType":"git"},{"version":"6b4959f43a04e12d39c5700607727f2cbcfeac31","status":"affected","lessThan":"834c23e4f798dcdc8af251b3c428ceef94741991","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/drm_mode_config.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.0","versionType":"semver"},{"version":"5.10.173","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.99","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.16","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.2.3","status":"unaffected","lessThanOrEqual":"6.2.*","versionType":"semver"},{"version":"6.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/drm_mode_config.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/5ae70041a6d7de62a0cdb2bbcfe0c9cf753035d0"},{"url":"https://git.kernel.org/stable/c/d06e827a65a6bcd2e329045d891d0739cec1cf4a"},{"url":"https://git.kernel.org/stable/c/b14147464251f66e38fa39f0aae9780466db8610"},{"url":"https://git.kernel.org/stable/c/961620ad67611a7320a49f4b6f3c5e2906833a03"},{"url":"https://git.kernel.org/stable/c/834c23e4f798dcdc8af251b3c428ceef94741991"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T19:21:42.566Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0","versionEndExcluding":"5.10.173"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0","versionEndExcluding":"5.15.99"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0","versionEndExcluding":"6.1.16"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0","versionEndExcluding":"6.2.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0","versionEndExcluding":"6.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}