PT-2025-25871 · Linux+2 · Linux Kernel+2

Published 2022-08-29 · Updated 2025-07-28 · CVE-2022-49945

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been identified, specifically in the gpio-fan driver. The issue arises from the driver's failure to check if the cooling state passed to gpio fan set cur state() exceeds the maximum cooling state stored in fan data->num speeds. This can lead to an array out of bounds access, potentially causing a kernel oops when unavailable memory is accessed. The vulnerability can be exploited by setting the state of the thermal cooling device to arbitrary values.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Improper Validation of Array Index

Weakness Enumeration

CWE-125

CWE-129

Related Identifiers

BDU:2026-02652

CVE-2022-49945

SUSE-SU-2025:02264-1

SUSE-SU-2025:02308-1

SUSE-SU-2025:02320-1

SUSE-SU-2025:02321-1

SUSE-SU-2025:02322-1

SUSE-SU-2025:02537-1

SUSE-SU-2025:2264-1

SUSE-SU-2025_02264-1

SUSE-SU-2025_02308-1

SUSE-SU-2025_02537-1

Affected Products

Astra Linux

Linux Kernel

Suse

References · 608

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49945.json · Exploit
• https://git.kernel.org/stable/c/f233d2be38dbbb22299192292983037f01ab363c · Patch
• https://git.kernel.org/stable/c/53196e0376205ed49b75bfd0475af5e0fbd20156 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:02308-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-49945 · Vendor Advisory
• https://git.kernel.org/stable/c/3263984c7acdcb0658155b05a724ed45a10de76d · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49945 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49945 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02537-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-49945 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02652 · Security Note
• https://git.kernel.org/stable/c/c8ae6a18708f260ccdeef6ba53af7548457dc26c · Patch
• https://git.kernel.org/stable/c/3ff866455e1e263a9ac1958095fd440984248e2f · Patch
• https://ubuntu.com/security/CVE-2022-49945 · Vendor Advisory
• https://git.kernel.org/stable/c/e9f6972ab40a82bd7f6d36800792ba2e084474d8 · Patch