PT-2025-8151 · Linux+2 · Linux Kernel+2

Ben Widawsky · Published 2022-02-17 · Updated 2025-09-29 · CVE-2022-49223

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.17.0-rc2+

Description A potential use-after-free issue has been identified in the Linux kernel, specifically in the cxl decoder release() function. This issue arises when the function attempts to reference its parent, a cxl port, to free its id back to port->decoder ida, after the parent has been released. The device core only guarantees parent lifetime until all children are unregistered, and if a child needs a parent to complete its ->release() callback, that child needs to hold a reference to extend the lifetime of the parent.

Recommendations For Linux kernel versions prior to 5.17.0-rc2+, consider holding a port reference until decoder release to prevent the use-after-free issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2025_16880

BDU:2025-10586

CVE-2022-49223

RHSA-2023:2458

RHSA-2023_2458

Affected Products

Astra Linux

Linux Kernel

Red Hat

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49223.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49223 · Vendor Advisory
• https://git.kernel.org/stable/c/b0022ca445d5fc4d0c89d15dcd0f855977b22c1d · Patch
• https://git.kernel.org/stable/c/518bb96367123062b48b0a9842f2864249b565f6 · Patch
• https://git.kernel.org/stable/c/49f2dab77a5e1354f5da6ccdc9346a8212697be2 · Patch
• https://git.kernel.org/stable/c/74be98774dfbc5b8b795db726bd772e735d2edd4 · Patch
• https://cve.org/CVERecord?id=CVE-2022-49223 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-49223 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49223 · Security Note
• https://bdu.fstec.ru/vul/2025-10586 · Security Note
• https://ubuntu.com/security/CVE-2022-49223 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-49223 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49223 · Vendor Advisory
• https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.19 · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note