{"cve":"CVE-2022-49258","nvd":{"published":"2025-02-26T07:01:02.720","modified":"2026-06-17T05:17:31.780","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccree - Fix use after free in cc_cipher_exit()\n\nkfree_sensitive(ctx_p->user.key) will free the ctx_p->user.key. But\nctx_p->user.key is still used in the next line, which will lead to a\nuse after free.\n\nWe can call kfree_sensitive() after dev_dbg() to avoid the uaf.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-416"],"references":["https://git.kernel.org/stable/c/25c358efee5153dfd240d4e0d3169d5bebe9cacd","https://git.kernel.org/stable/c/335bf1fc74f775a8255257aa3e33763f2257b676","https://git.kernel.org/stable/c/3d950c34074ed74d2713c3856ba01264523289e6","https://git.kernel.org/stable/c/c93017c8d5ebf55a4e453ac7c84cc84cf92ab570","https://git.kernel.org/stable/c/cffb5382bd8d3cf21b874ab5b84bf7618932286b"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T21:59:48.811064707+00:00"},"epss":{"cve":"CVE-2022-49258","score":0.00268,"percentile":0.18952,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}