PT-2025-25980 · Linux+4 · Linux Kernel+4

Published 2022-08-12 · Updated 2025-07-15 · CVE-2022-50054

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:L/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the fixed version

Description A NULL pointer dereference issue has been identified in the Linux kernel, specifically in the iavf get link ksettings function. This issue can occur when the adapter->vf res is freed, but the netdev is still registered, allowing ethtool ops to be called. As a result, calling iavf get link ksettings without vf res can lead to a kernel NULL pointer dereference. The issue is related to a regression introduced in a previous commit, where receiving IAVF ERR ADMIN QUEUE NO WORK from iavf get vf config would free adapter->vf res.

Recommendations To resolve this issue, update the Linux kernel to a version that includes the fix for the NULL pointer dereference in iavf get link ksettings. As a temporary workaround, consider disabling the iavf get link ksettings function until a patch is available. Restrict access to the vulnerable module to minimize the risk of exploitation. Avoid using the affected API endpoint until the issue is resolved.

Exploit

Fix

Improper Resource Release

NULL Pointer Dereference

Weakness Enumeration

CWE-404

CWE-476

Related Identifiers

BDU:2026-04877

CESA-2022_7110

CESA-2022_7683

CVE-2022-50054

RHSA-2022:7110

RHSA-2022:7683

RHSA-2022_7110

RHSA-2022_7683

RHSA-2023:0334

RHSA-2023:2458

RHSA-2023_0334

RHSA-2023_2458

SUSE-SU-2025:02264-1

SUSE-SU-2025:02321-1

SUSE-SU-2025:2264-1

SUSE-SU-2025_02264-1

Affected Products

Astra Linux

Centos

Linux Kernel

Red Hat

Suse

References · 579

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50054.json · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-50054 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02321-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-50054 · Security Note
• https://git.kernel.org/stable/c/b305c7e9363f5a174ee08ac5f056e4b209f0325b · Patch
• https://ubuntu.com/security/CVE-2022-50054 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50054 · Security Note
• https://git.kernel.org/stable/c/541a1af451b0cb3779e915d48d08efb17915207b · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-50054 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04877 · Security Note
• https://osv.dev/vulnerability/CVE-2022-50054 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-50054 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02264-1 · Vendor Advisory
• https://bugzilla.suse.com/1243627 · Note
• https://suse.com/security/cve/CVE-2022-49937 · Note