Use-After-Free Vulnerability in Linux Kernel's Regulator Core

CVE-2022-50616

What is CVE-2022-50616?

A use-after-free vulnerability has been identified in the Linux kernel's regulator core, specifically related to the resource allocation and device tree (DT) lookup processes. This issue arises due to improper handling of initialization data when a parent device releases resources while the regulator core continues to operate on them. This can lead to instability and exploitation risks as the regulator may attempt to access freed memory regions. A patch has been implemented to address this by allowing the 'regulator_register' API to utilize different devices for both resource allocation and DT lookup, thereby mitigating the risk associated with this vulnerability.

References