Answer in brief
CVE-2022-50411 records a Unknown severity vulnerability in ACPICA: Fix error code path in acpi_ds_call_control_method(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2022-50411 records a Unknown severity vulnerability in ACPICA: Fix error code path in acpi_ds_call_control_method(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <38e251d356a01b61a86cb35213cafd7e8fe7090c || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <f520d181477ec29a496c0b3bbfbdb7e2606c2713 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <2deb42c4f9776e59bee247c14af9c5e8c05ca9a6 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <9ef353c92f9d04c88de3af1a46859c1fb76db0f8 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <b0b83d3f3ffa96e8395c56b83d6197e184902a34 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <5777432ebaaf797e24f059979b42df3139967163 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <0462fec709d51762ba486245bc344f44cc6cfa97 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <799881db3e03b5e98fe6a900d9d7de8c7d61e7ee || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <404ec60438add1afadaffaed34bb5fe4ddcadd40 | 38e251d356a01b61a86cb35213cafd7e8fe7090c, f520d181477ec29a496c0b3bbfbdb7e2606c2713, 2deb42c4f9776e59bee247c14af9c5e8c05ca9a6, 9ef353c92f9d04c88de3af1a46859c1fb76db0f8, b0b83d3f3ffa96e8395c56b83d6197e184902a34, 5777432ebaaf797e24f059979b42df3139967163, 0462fec709d51762ba486245bc344f44cc6cfa97, 799881db3e03b5e98fe6a900d9d7de8c7d61e7ee, 404ec60438add1afadaffaed34bb5fe4ddcadd40 |
| Linux/Linuxgeneric | 2.6.12 | Not reported |
Published upstream
Sep 18, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix error code path in acpi_ds_call_control_method() A use-after-free in acpi_ps_parse_aml() after a failing invocaion of acpi_ds_call_control_method() is reported by KASAN [1] and code inspection reveals that next_walk_state pushed to the thread by acpi_ds_create_walk_state() is freed on errors, but it is not popped from the thread beforehand. Thus acpi_ds_get_current_walk_state() called by acpi_ps_parse_aml() subsequently returns it as the new walk state which is incorrect. To address this, make acpi_ds_call_control_method() call acpi_ds_pop_walk_state() to pop next_walk_state from the thread before returning an error.
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <38e251d356a01b61a86cb35213cafd7e8fe7090c || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <f520d181477ec29a496c0b3bbfbdb7e2606c2713 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <2deb42c4f9776e59bee247c14af9c5e8c05ca9a6 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <9ef353c92f9d04c88de3af1a46859c1fb76db0f8 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <b0b83d3f3ffa96e8395c56b83d6197e184902a34 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <5777432ebaaf797e24f059979b42df3139967163 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <0462fec709d51762ba486245bc344f44cc6cfa97 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <799881db3e03b5e98fe6a900d9d7de8c7d61e7ee || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <404ec60438add1afadaffaed34bb5fe4ddcadd40 | 38e251d356a01b61a86cb35213cafd7e8fe7090c, f520d181477ec29a496c0b3bbfbdb7e2606c2713, 2deb42c4f9776e59bee247c14af9c5e8c05ca9a6, 9ef353c92f9d04c88de3af1a46859c1fb76db0f8, b0b83d3f3ffa96e8395c56b83d6197e184902a34, 5777432ebaaf797e24f059979b42df3139967163, 0462fec709d51762ba486245bc344f44cc6cfa97, 799881db3e03b5e98fe6a900d9d7de8c7d61e7ee, 404ec60438add1afadaffaed34bb5fe4ddcadd40 |
| Linux/Linuxgeneric | 2.6.12 | Not reported |
Published upstream
Sep 18, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix error code path in acpi_ds_call_control_method() A use-after-free in acpi_ps_parse_aml() after a failing invocaion of acpi_ds_call_control_method() is reported by KASAN [1] and code inspection reveals that next_walk_state pushed to the thread by acpi_ds_create_walk_state() is freed on errors, but it is not popped from the thread beforehand. Thus acpi_ds_get_current_walk_state() called by acpi_ps_parse_aml() subsequently returns it as the new walk state which is incorrect. To address this, make acpi_ds_call_control_method() call acpi_ds_pop_walk_state() to pop next_walk_state from the thread before returning an error.
Quoted source text, attributed separately from HOL analysis.