PT-2025-8080 · Linux+2 · Linux Kernel+2

Published 2022-11-15 · Updated 2025-09-29 · CVE-2022-49152

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the version where the fix for xas create range() is included

Description A issue in the Linux kernel has been identified, related to the XArray function xas create range(). When an entry of order >= XA CHUNK SHIFT is already present, xas create range() misinterprets this entry as a node and attempts to dereference xa node->parent, typically resulting in a crash. This issue is deterministically reproducible and has been present since the introduction of xas create range(), although it may require specific conditions to occur in a live kernel.

Recommendations For Linux kernel versions prior to the fixed version, consider applying the patch that fixes xas create range() to resolve the issue. As a temporary workaround, restricting the use of multi-order entries in XArray may help minimize the risk of exploitation. However, the most effective solution is to update to a version of the Linux kernel where this issue has been addressed. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALSA-2025_16880

CVE-2022-49152

RHSA-2022:8267

RHSA-2022_8267

Affected Products

Astra Linux

Linux Kernel

Red Hat

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49152.json · Exploit
• https://git.kernel.org/stable/c/18f13edf3424b3b61814b69d5269b2e14584800c · Patch
• https://git.kernel.org/stable/c/29968329b926d238e3107ec071a250397555d264 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49152 · Vendor Advisory
• https://git.kernel.org/stable/c/7521a97b1929042604bef6859f62fa8b4bbc077b · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49152 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-49152 · Vendor Advisory
• https://git.kernel.org/stable/c/3e3c658055c002900982513e289398a1aad4a488 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49152 · Security Note
• https://git.kernel.org/stable/c/1ac49c8fd49fdf53d3cd8b77eb8ffda08d7fbe22 · Patch
• https://osv.dev/vulnerability/CVE-2022-49152 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-49152 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49152 · Security Note
• https://git.kernel.org/stable/c/3e2852eda19ee1a400cd809d7a9322680f34a262 · Patch
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note