{"id":"CVE-2022-50305","title":"ASoC: sof_es8336: fix possible use-after-free in sof_es8336_remove()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: sof_es8336: fix possible use-after-free in sof_es8336_remove()\n\nsof_es8336_remove() calls cancel_delayed_work(). However, that\nfunction does not wait until the wo…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= b60ee210a76cabdc2dd5396de299a1860b4945cd < b85102a3aa3810a09eb55692e8cd6ffbb304e57d","Linux >= 89cdb224f2abe37ec4ac21ba0d9ddeb5a6a9cf68 < 390a1a98288a53b2e7555097d83c6e55d579b166","Linux >= 89cdb224f2abe37ec4ac21ba0d9ddeb5a6a9cf68 < 1b41beaa7a58467505ec3023af8aad74f878b888","Linux >= 6.0.11 < 6.0.16","Linux 6.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:09:21.410857Z"},"published":"2025-09-15","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:10:33.903Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2022-50305","references":[{"url":"https://git.kernel.org/stable/c/b85102a3aa3810a09eb55692e8cd6ffbb304e57d"},{"url":"https://git.kernel.org/stable/c/390a1a98288a53b2e7555097d83c6e55d579b166"},{"url":"https://git.kernel.org/stable/c/1b41beaa7a58467505ec3023af8aad74f878b888"}],"tags":["cve.org"],"epss":0.00161,"epssPercentile":0.05322,"ingestedAt":"2026-11-05T22:38:31.723Z","slug":"CVE-2022-50305","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nASoC: sof_es8336: fix possible use-after-free in sof_es8336_remove()\n\nsof_es8336_remove() calls cancel_delayed_work(). However, that\nfunction does not wait until the work function finishes. This\nmeans that the callback function may still be running after\nthe driver's remove function has finished, which would result\nin a use-after-free.\n\nFix by calling cancel_delayed_work_sync(), which ensures that\nthe work is properly cancelled, no longer running, and unable\nto re-schedule itself.\n\n## Affected\n\n- `Linux >= b60ee210a76cabdc2dd5396de299a1860b4945cd < b85102a3aa3810a09eb55692e8cd6ffbb304e57d`\n- `Linux >= 89cdb224f2abe37ec4ac21ba0d9ddeb5a6a9cf68 < 390a1a98288a53b2e7555097d83c6e55d579b166`\n- `Linux >= 89cdb224f2abe37ec4ac21ba0d9ddeb5a6a9cf68 < 1b41beaa7a58467505ec3023af8aad74f878b888`\n- `Linux >= 6.0.11 < 6.0.16`\n- `Linux 6.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}