---
id: CVE-2022-50677
title: 'ipmi: fix use after free in _ipmi_destroy_user()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipmi: fix use after free in _ipmi_destroy_user()

  The intf_free() function frees the "intf" pointer so we cannot
  dereference it again on the next line.
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f9d405a4bd6090ffbf3bba5e2da6b44c0e013cb3 <
    35ad87bfe330f7ef6a19f772223c63296d643172
  - >-
    Linux >= b642ced2cad496c32ae1f62b85fc395391190820 <
    d23006f2a56e11a3103de0ca8b843bf7fd7d76fc
  - >-
    Linux >= cbb79863fc3175ed5ac506465948b02a893a8235 <
    f29d127b372e1b7662397d92341d9f7de198ff99
  - >-
    Linux >= cbb79863fc3175ed5ac506465948b02a893a8235 <
    bfce073089cb81482521c65061835aaa6d1a6cc0
  - >-
    Linux >= cbb79863fc3175ed5ac506465948b02a893a8235 <
    f7fde441198a9ecb130c3ccec91ee2131d6998ee
  - >-
    Linux >= cbb79863fc3175ed5ac506465948b02a893a8235 <
    1fc9b20a7688000fcf4d7fbaa58e415a3cdda961
  - >-
    Linux >= cbb79863fc3175ed5ac506465948b02a893a8235 <
    a92ce570c81dc0feaeb12a429b4bc65686d17967
  - Linux >= 4.19.92 < 4.19.270
  - Linux >= 5.4.7 < 5.4.229
  - Linux 5.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:32:00.835660Z'
published: '2025-12-09'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T21:41:22.782Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-50677'
references:
  - url: 'https://git.kernel.org/stable/c/35ad87bfe330f7ef6a19f772223c63296d643172'
  - url: 'https://git.kernel.org/stable/c/d23006f2a56e11a3103de0ca8b843bf7fd7d76fc'
  - url: 'https://git.kernel.org/stable/c/f29d127b372e1b7662397d92341d9f7de198ff99'
  - url: 'https://git.kernel.org/stable/c/bfce073089cb81482521c65061835aaa6d1a6cc0'
  - url: 'https://git.kernel.org/stable/c/f7fde441198a9ecb130c3ccec91ee2131d6998ee'
  - url: 'https://git.kernel.org/stable/c/1fc9b20a7688000fcf4d7fbaa58e415a3cdda961'
  - url: 'https://git.kernel.org/stable/c/a92ce570c81dc0feaeb12a429b4bc65686d17967'
tags:
  - cve.org
epss: 0.00172
epssPercentile: 0.06154
ingestedAt: '2026-10-15T22:48:25.380Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ipmi: fix use after free in _ipmi_destroy_user()

The intf_free() function frees the "intf" pointer so we cannot
dereference it again on the next line.

## Affected

- `Linux >= f9d405a4bd6090ffbf3bba5e2da6b44c0e013cb3 < 35ad87bfe330f7ef6a19f772223c63296d643172`
- `Linux >= b642ced2cad496c32ae1f62b85fc395391190820 < d23006f2a56e11a3103de0ca8b843bf7fd7d76fc`
- `Linux >= cbb79863fc3175ed5ac506465948b02a893a8235 < f29d127b372e1b7662397d92341d9f7de198ff99`
- `Linux >= cbb79863fc3175ed5ac506465948b02a893a8235 < bfce073089cb81482521c65061835aaa6d1a6cc0`
- `Linux >= cbb79863fc3175ed5ac506465948b02a893a8235 < f7fde441198a9ecb130c3ccec91ee2131d6998ee`
- `Linux >= cbb79863fc3175ed5ac506465948b02a893a8235 < 1fc9b20a7688000fcf4d7fbaa58e415a3cdda961`
- `Linux >= cbb79863fc3175ed5ac506465948b02a893a8235 < a92ce570c81dc0feaeb12a429b4bc65686d17967`
- `Linux >= 4.19.92 < 4.19.270`
- `Linux >= 5.4.7 < 5.4.229`
- `Linux 5.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.