{"id":"CVE-2022-50317","title":"drm/bridge: megachips: Fix a null pointer dereference bug","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/bridge: megachips: Fix a null pointer dereference bug\n\nWhen removing the module we will get the following warning:\n\n[   31.911505] i2c-core: driver [stdp2690-ge-b85…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 7649972d97fb98578fbc4a351416cf72895e7c4d < aaa512ad1e59f2edf8a9e4f2b167a44b24670679","Linux >= 16e3827904932eccfba0915f0c93b519de3536ac < 5bc20bafcd87ba0858ab772cefc7047cb51bc249","Linux >= 50ad94f8654a53ec9ca3604a7a23cbaf166e0119 < 1daf69228e310938177119c4eadcd30fc75c81e0","Linux >= b8d10f601f226f055df8b5368d7ea7f369136cd5 < 877e92e9b1bdeb580b31a46061005936be902cd4","Linux >= 405856460d3e7aefb7c1aef047ec88fc4ef2e2a5 < 4610e7a4111fa3f3ce27c09d6d94008c55f1cd31","Linux >= 11632d4aa2b3f126790e81a4415d6c23103cf8bb < 21764467ab396d9f08921e0a5ffa1214244e1ad9","Linux >= 11632d4aa2b3f126790e81a4415d6c23103cf8bb < 7371fad5cfe6eada6bb5523c895fd6074b15c2b9","Linux >= 11632d4aa2b3f126790e81a4415d6c23103cf8bb < 1ff673333d46d2c1b053ebd0c1c7c7c79e36943e","Linux e449461989f0674f188d30494ffd3f5ba74c1a05","Linux >= 4.14.263 < 4.14.296","Linux >= 4.19.226 < 4.19.262","Linux >= 5.4.174 < 5.4.220","Linux >= 5.10.94 < 5.10.150","Linux >= 5.15.17 < 5.15.75","Linux >= 5.16.3 < 5.17","Linux 5.17"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T20:09:41.260250Z"},"published":"2025-09-15","updated":"2026-11-05","sourceUpdated":"2026-11-05T20:10:34.680Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2022-50317","references":[{"url":"https://git.kernel.org/stable/c/aaa512ad1e59f2edf8a9e4f2b167a44b24670679"},{"url":"https://git.kernel.org/stable/c/5bc20bafcd87ba0858ab772cefc7047cb51bc249"},{"url":"https://git.kernel.org/stable/c/1daf69228e310938177119c4eadcd30fc75c81e0"},{"url":"https://git.kernel.org/stable/c/877e92e9b1bdeb580b31a46061005936be902cd4"},{"url":"https://git.kernel.org/stable/c/4610e7a4111fa3f3ce27c09d6d94008c55f1cd31"},{"url":"https://git.kernel.org/stable/c/21764467ab396d9f08921e0a5ffa1214244e1ad9"},{"url":"https://git.kernel.org/stable/c/7371fad5cfe6eada6bb5523c895fd6074b15c2b9"},{"url":"https://git.kernel.org/stable/c/1ff673333d46d2c1b053ebd0c1c7c7c79e36943e"}],"tags":["cve.org"],"epss":0.0016,"epssPercentile":0.0515,"ingestedAt":"2026-11-05T22:38:31.725Z","slug":"CVE-2022-50317","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/bridge: megachips: Fix a null pointer dereference bug\n\nWhen removing the module we will get the following warning:\n\n[   31.911505] i2c-core: driver [stdp2690-ge-b850v3-fw] unregistered\n[   31.912484] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI\n[   31.913338] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n[   31.915280] RIP: 0010:drm_bridge_remove+0x97/0x130\n[   31.921825] Call Trace:\n[   31.922533]  stdp4028_ge_b850v3_fw_remove+0x34/0x60 [megachips_stdpxxxx_ge_b850v3_fw]\n[   31.923139]  i2c_device_remove+0x181/0x1f0\n\nThe two bridges (stdp2690, stdp4028) do not probe at the same time, so\nthe driver does not call ge_b850v3_resgiter() when probing, causing the\ndriver to try to remove the object that has not been initialized.\n\nFix this by checking whether both the bridges are probed.\n\n## Affected\n\n- `Linux >= 7649972d97fb98578fbc4a351416cf72895e7c4d < aaa512ad1e59f2edf8a9e4f2b167a44b24670679`\n- `Linux >= 16e3827904932eccfba0915f0c93b519de3536ac < 5bc20bafcd87ba0858ab772cefc7047cb51bc249`\n- `Linux >= 50ad94f8654a53ec9ca3604a7a23cbaf166e0119 < 1daf69228e310938177119c4eadcd30fc75c81e0`\n- `Linux >= b8d10f601f226f055df8b5368d7ea7f369136cd5 < 877e92e9b1bdeb580b31a46061005936be902cd4`\n- `Linux >= 405856460d3e7aefb7c1aef047ec88fc4ef2e2a5 < 4610e7a4111fa3f3ce27c09d6d94008c55f1cd31`\n- `Linux >= 11632d4aa2b3f126790e81a4415d6c23103cf8bb < 21764467ab396d9f08921e0a5ffa1214244e1ad9`\n- `Linux >= 11632d4aa2b3f126790e81a4415d6c23103cf8bb < 7371fad5cfe6eada6bb5523c895fd6074b15c2b9`\n- `Linux >= 11632d4aa2b3f126790e81a4415d6c23103cf8bb < 1ff673333d46d2c1b053ebd0c1c7c7c79e36943e`\n- `Linux e449461989f0674f188d30494ffd3f5ba74c1a05`\n- `Linux >= 4.14.263 < 4.14.296`\n- `Linux >= 4.19.226 < 4.19.262`\n- `Linux >= 5.4.174 < 5.4.220`\n- `Linux >= 5.10.94 < 5.10.150`\n- `Linux >= 5.15.17 < 5.15.75`\n- `Linux >= 5.16.3 < 5.17`\n- `Linux 5.17`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}