PT-2025-13298 · Linux+2 · Linux Kernel+2

Published 2025-03-27 · Updated 2025-05-29 · CVE-2022-49756

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A potential null pointer dereference issue has been identified in the Linux kernel, specifically in the sp usb phy probe() function. This function calls platform get resource byname(), which may return NULL, and subsequently, devm ioremap() uses usbphy->moon4 res mem->start as input, potentially causing a null pointer dereference. The issue is resolved by checking the return value of platform get resource byname() to avoid the null pointer dereference.

Recommendations For the affected Linux kernel versions, check the return value of platform get resource byname() in the sp usb phy probe() function to avoid null pointer dereferences. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2025-06302

CVE-2022-49756

Affected Products

Astra Linux

Linux Kernel

Red Os

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49756.json · Exploit
• https://security-tracker.debian.org/tracker/CVE-2022-49756 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49756 · Security Note
• https://osv.dev/vulnerability/CVE-2022-49756 · Vendor Advisory
• https://git.kernel.org/stable/c/17eee264ef386ef30a69dd70e36f29893b85c170 · Patch
• https://bdu.fstec.ru/vul/2025-06302 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-49756 · Security Note
• https://ubuntu.com/security/CVE-2022-49756 · Vendor Advisory
• https://git.kernel.org/stable/c/d838b5c99bcecd593b4710a93fce8fdbf122395b · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49756 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49756 · Vendor Advisory
• https://redos.red-soft.ru/support/secure · Note
• https://twitter.com/CVEnew/status/1905361872464810000 · Twitter Post
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://git.kernel.org/linus/17eee264ef386ef30a69dd70e36f29893b85c170 · Note