PT-2025-25888 · Linux+4 · Linux Kernel+4

Published 2022-08-25 · Updated 2025-07-15 · CVE-2022-49962

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A null pointer dereference issue has been identified in the Linux kernel's xhci platform driver. This issue occurs when the remove path attempts to remove and put both main and shared hcds, even if only a main hcd exists, resulting in a null pointer dereference during reboot for certain controllers. The problem arises from not checking if the shared hcd exists before trying to remove it.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Resource Release

NULL Pointer Dereference

Weakness Enumeration

CWE-404

CWE-476

Related Identifiers

BDU:2026-02038

CESA-2023_2951

CVE-2022-49962

RHSA-2023:2458

RHSA-2023:2951

RHSA-2023_2458

RHSA-2023_2951

SUSE-SU-2025:02264-1

SUSE-SU-2025:02321-1

SUSE-SU-2025:2264-1

SUSE-SU-2025_02264-1

Affected Products

Astra Linux

Centos

Linux Kernel

Red Hat

Suse

References · 579

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49962.json · Exploit
• https://ubuntu.com/security/CVE-2022-49962 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02038 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-49962 · Vendor Advisory
• https://git.kernel.org/stable/c/4a593a62a9e3a25ab4bc37f612e4edec144f7f43 · Patch
• https://osv.dev/vulnerability/CVE-2022-49962 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49962 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02321-1 · Vendor Advisory
• https://git.kernel.org/stable/c/7081b2f34ff291ada012bd6abacaf7d51c4cf73f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49962 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-49962 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49962 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02264-1 · Vendor Advisory
• https://bugzilla.suse.com/1243627 · Note
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.8 · Note