PT-2025-18540 · Linux+2 · Linux Kernel+2
Published
2022-11-08
·
Updated
2025-11-10
·
CVE-2022-49823
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.1.0-rc3+
Description
The issue arises from the function
ata tdev add() not checking the return value of transport add device(), leading to a null pointer dereference when removing the module because transport remove device() is called to remove a device that was not added. This results in a kernel NULL pointer dereference. The problem is fixed by checking and handling the return value of transport add device() in ata tdev add().Recommendations
For Linux kernel versions prior to 6.1.0-rc3+, update to a version that includes the fix for the error handling in
ata tdev add(). As a temporary workaround, consider avoiding the removal of the module until a patch is available.Exploit
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Suse