PT-2025-18541 · Linux+2 · Linux Kernel+2
Published
2025-05-01
·
Updated
2025-11-10
·
CVE-2022-49824
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.1.0-rc3+
Description
A vulnerability in the Linux kernel has been resolved, specifically in the libata-transport module. The issue arises from the lack of error handling in the
ata tlink add() function, where the return value of transport add device() is not checked. This results in a null pointer dereference when removing the module, as transport remove device() is called to remove a device that was not added. The error occurs at virtual address 00000000000000d0 and is related to the device del() function.Recommendations
To resolve this issue, check and handle the return value of
transport add device() in ata tlink add(). This can be achieved by verifying the return value and taking appropriate actions to prevent the null pointer dereference. As a temporary workaround, consider disabling the ata tlink add() function until a patch is available. However, the most effective solution is to update to a version of the Linux kernel that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability, but it is recommended to keep the kernel up to date to ensure the latest security patches are applied.Exploit
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Suse