https://vulnerability.circl.lu/sightings/feed 2026-06-08T03:08:03.129272+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/f210f4ed-06f0-4d7a-9bdd-e4459f8486dc/export 2026-06-08T03:08:03.513436+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "f210f4ed-06f0-4d7a-9bdd-e4459f8486dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-48735", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/16479", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-48735\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda: Fix UAF of leds class devs at unbinding\n\nThe LED class devices that are created by HD-audio codec drivers are\nregistered via devm_led_classdev_register() and associated with the\nHD-audio codec device. Unfortunately, it turned out that the devres\nrelease doesn't work for this case; namely, since the codec resource\nrelease happens before the devm call chain, it triggers a NULL\ndereference or a UAF for a stale set_brightness_delay callback.\n\nFor fixing the bug, this patch changes the LED class device register\nand unregister in a manual manner without devres, keeping the\ninstances in hda_gen_spec.\n\ud83d\udccf Published: 2024-06-20T11:13:22.065Z\n\ud83d\udccf Modified: 2025-05-15T12:28:07.326Z\n\ud83d\udd17 References:\n1. https://git.kernel.org/stable/c/a7de1002135cf94367748ffc695a29812d7633b5\n2. https://git.kernel.org/stable/c/0e629052f013eeb61494d4df2f1f647c2a9aef47\n3. https://git.kernel.org/stable/c/813e9f3e06d22e29872d4fd51b54992d89cf66c8\n4. https://git.kernel.org/stable/c/549f8ffc7b2f7561bea7f90930b6c5104318e87b", "creation_timestamp": "2025-05-15T12:34:26.000000Z"} 2025-05-15T12:34:26+00:00