PT-2025-25873 · Linux+1 · Linux Kernel+1

Published

2022-09-01

·

Updated

2025-06-19

·

CVE-2022-49947

CVSS v3.1

5.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.0.0-rc1-next-20220819-syzkaller
Description A null-ptr dereference issue has been resolved in the Linux kernel. The issue occurred when a binder proc received a transaction without having previously called mmap() to setup the binder proc->alloc space. This could happen when attempting to acquire the mmap lock when alloc->vma vm mm has not been initialized yet. The issue was reported by Syzbot and was introduced by a commit that added missing mmap lock calls when using the VMA. The fix involves setting up the alloc->vma vm mm pointer during open() and caching directly from current->mm to guarantee a valid reference to take the mmap lock.
Recommendations For Linux kernel versions prior to 6.0.0-rc1-next-20220819-syzkaller, the issue can be resolved by applying the fix that sets up the alloc->vma vm mm pointer during open() and caches directly from current->mm. As a temporary workaround, consider restricting access to the vulnerable binder alloc new buf locked function until a patch is available.

Exploit

Fix

NULL Pointer Dereference

Improper Initialization

Weakness Enumeration

CWE-476CWE-665

Related Identifiers

BDU:2026-02654
CVE-2022-49947

Affected Products

Astra Linux
Linux Kernel