{"id":"CVE-2022-22058","aliases":["2338216","2747422","A-209075540","ASB-A-209075540","EUVD-2022-27212","GHSA-frf4-63qc-6hf3"],"status":"published","title":"Memory corruption due to use after free issue in kernel while processing ION handles in...","description":"Memory corruption due to use after free issue in kernel while processing ION handles in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00164,"percentile":0.05613,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2022-07-01T00:00:00Z","modified":"2026-11-05T16:32:28Z","fixes":[{"ecosystem":"Android","package":":linux_kernel:Qualcomm","fixed_in":["SoCVersion:2022-07-05"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Android","package":":linux_kernel:Qualcomm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"SoCVersion:0"},{"fixed":"SoCVersion:2022-07-05"}]}],"versions":["SoCVersion"]}],"products":[{"vendor":"qualcomm","product":"apq8009_firmware"},{"vendor":"qualcomm","product":"apq8009w_firmware"},{"vendor":"qualcomm","product":"apq8017_firmware"},{"vendor":"qualcomm","product":"apq8053_firmware"},{"vendor":"qualcomm","product":"apq8096au_firmware"},{"vendor":"qualcomm","product":"aqt1000_firmware"},{"vendor":"qualcomm","product":"csrb31024_firmware"},{"vendor":"qualcomm","product":"mdm9150_firmware"},{"vendor":"qualcomm","product":"mdm9206_firmware"},{"vendor":"qualcomm","product":"mdm9250_firmware"},{"vendor":"qualcomm","product":"mdm9607_firmware"},{"vendor":"qualcomm","product":"mdm9626_firmware"},{"vendor":"qualcomm","product":"mdm9628_firmware"},{"vendor":"qualcomm","product":"mdm9640_firmware"},{"vendor":"qualcomm","product":"mdm9650_firmware"},{"vendor":"qualcomm","product":"msm8909w_firmware"},{"vendor":"qualcomm","product":"msm8917_firmware"},{"vendor":"qualcomm","product":"msm8937_firmware"},{"vendor":"qualcomm","product":"msm8953_firmware"},{"vendor":"qualcomm","product":"msm8996au_firmware"},{"vendor":"qualcomm","product":"pm8937_firmware"},{"vendor":"qualcomm","product":"qca4020_firmware"},{"vendor":"qualcomm","product":"qca6174a_firmware"},{"vendor":"qualcomm","product":"qca6175a_firmware"},{"vendor":"qualcomm","product":"qca6310_firmware"},{"vendor":"qualcomm","product":"qca6320_firmware"},{"vendor":"qualcomm","product":"qca6335_firmware"},{"vendor":"qualcomm","product":"qca6420_firmware"},{"vendor":"qualcomm","product":"qca6430_firmware"},{"vendor":"qualcomm","product":"qca6564a_firmware"},{"vendor":"qualcomm","product":"qca6564au_firmware"},{"vendor":"qualcomm","product":"qca6574_firmware"},{"vendor":"qualcomm","product":"qca6574a_firmware"},{"vendor":"qualcomm","product":"qca6574au_firmware"},{"vendor":"qualcomm","product":"qca6584_firmware"},{"vendor":"qualcomm","product":"qca6595au_firmware"},{"vendor":"qualcomm","product":"qca6696_firmware"},{"vendor":"qualcomm","product":"qca9367_firmware"},{"vendor":"qualcomm","product":"qca9377_firmware"},{"vendor":"qualcomm","product":"qca9379_firmware"},{"vendor":"qualcomm","product":"qcn7605_firmware"},{"vendor":"qualcomm","product":"qcn7606_firmware"},{"vendor":"qualcomm","product":"qcs603_firmware"},{"vendor":"qualcomm","product":"qcs605_firmware"},{"vendor":"qualcomm","product":"qualcomm215_firmware"},{"vendor":"qualcomm","product":"sa415m_firmware"},{"vendor":"qualcomm","product":"sd429_firmware"},{"vendor":"qualcomm","product":"sd439_firmware"},{"vendor":"qualcomm","product":"sd450_firmware"},{"vendor":"qualcomm","product":"sd632_firmware"},{"vendor":"qualcomm","product":"sd660_firmware"},{"vendor":"qualcomm","product":"sd670_firmware"},{"vendor":"qualcomm","product":"sd710_firmware"},{"vendor":"qualcomm","product":"sd820_firmware"},{"vendor":"qualcomm","product":"sd835_firmware"},{"vendor":"qualcomm","product":"sd845_firmware"},{"vendor":"qualcomm","product":"sd855_firmware"},{"vendor":"qualcomm","product":"sdm429w_firmware"},{"vendor":"qualcomm","product":"sdw2500_firmware"},{"vendor":"qualcomm","product":"sdx20_firmware"},{"vendor":"qualcomm","product":"sdx24_firmware"},{"vendor":"qualcomm","product":"sdxr1_firmware"},{"vendor":"qualcomm","product":"wcd9326_firmware"},{"vendor":"qualcomm","product":"wcd9330_firmware"},{"vendor":"qualcomm","product":"wcd9335_firmware"},{"vendor":"qualcomm","product":"wcd9340_firmware"},{"vendor":"qualcomm","product":"wcd9341_firmware"},{"vendor":"qualcomm","product":"wcn3610_firmware"},{"vendor":"qualcomm","product":"wcn3615_firmware"},{"vendor":"qualcomm","product":"wcn3620_firmware"},{"vendor":"qualcomm","product":"wcn3660_firmware"},{"vendor":"qualcomm","product":"wcn3660b_firmware"},{"vendor":"qualcomm","product":"wcn3680_firmware"},{"vendor":"qualcomm","product":"wcn3680b_firmware"},{"vendor":"qualcomm","product":"wcn3980_firmware"},{"vendor":"qualcomm","product":"wcn3990_firmware"},{"vendor":"qualcomm","product":"wcn3998_firmware"},{"vendor":"qualcomm","product":"wsa8810_firmware"},{"vendor":"qualcomm","product":"wsa8815_firmware"},{"vendor":"qualcomm, inc.","product":"snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice \u0026 music, snapdragon wearables"}],"references":[{"url":"https://www.qualcomm.com/company/product-security/bulletins/july-2022-bulletin","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22058"},{"url":"https://github.com/advisories/GHSA-frf4-63qc-6hf3"},{"url":"https://source.android.com/security/bulletin/2022-07-01","tags":["advisory"]},{"url":"https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=6186c322d99c4c35f18a777eef158486a9d24ec9","tags":["fix"]},{"url":"https://git.codelinaro.org/clo/la/kernel/msm-4.4/-/commit/52ad8f0aff9106ce15cd6c1ff6a029255cb6843a","tags":["fix"]}],"sources":{"cve":[{"id":"CVE-2022-22058","description":"Memory corruption due to use after free issue in kernel while processing ION handles in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables","status":"published","published":"2022-09-26T16:35:09Z","modified":"2025-05-21T15:13:53.906Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:34:26.645563Z"}],"euvd":[{"id":"EUVD-2022-27212","description":"Memory corruption due to use after free issue in kernel while processing ION handles in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables","status":"published","published":"2022-09-26T16:35:09Z","modified":"2025-05-21T15:13:53Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:41.46277Z"}],"ghsa":[{"id":"GHSA-frf4-63qc-6hf3","title":"Memory corruption due to use after free issue in kernel while processing ION handles in...","description":"Memory corruption due to use after free issue in kernel while processing ION handles in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables","status":"published","published":"2022-09-27T00:00:17Z","modified":"2023-01-27T05:08:17Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:43:16.659055Z"}],"nvd":[{"id":"CVE-2022-22058","description":"Memory corruption due to use after free issue in kernel while processing ION handles in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables","status":"published","published":"2022-09-26T17:15:10.173Z","modified":"2026-06-17T04:27:35.17Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:07:28.501364Z"}],"osv":[{"id":"ASB-A-209075540","status":"published","published":"2022-07-01T00:00:00Z","modified":"2026-11-10T17:02:23.040266809Z","updated_at":"2026-11-09T17:04:22.742827Z"}]}}