CVE-2022-50305

In the Linux kernel, the following vulnerability has been resolved:

ASoC: sof_es8336: fix possible use-after-free in sof_es8336_remove()

sof_es8336_remove() calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function has finished, which would result in a use-after-free.

Fix by calling cancel_delayed_work_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedule itself.

The issue is a race in the ASoC sof_es8336 remove path: a delayed work item could still run after the driver was torn down, causing a use-after-free and potential kernel panic. The fix switches to cancel_delayed_work_sync() to guarantee completion before teardown. Exploitation requires local privileged control over device/driver removal (e.g., root unloading the module or device hot-unplug), so this is not a universal remote bug.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.