PT-2025-8310 · Linux+4 · Linux Kernel+4

Dongliang Mu · Published 2023-05-09 · Updated 2025-09-29 · CVE-2022-49376

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A potential NULL pointer dereference issue has been identified in the Linux kernel. The problem occurs when the sd probe() function encounters an early error before the sdkp->device is initialized, leading to the sd zbc release disk() function being called. This results in a NULL pointer dereference when sd is zoned() is called within that function. The issue is resolved by removing the call to sd zbc release disk() in the sd probe() error path. This change does not cause zone information memory leakage because the zone information for a zoned disk is allocated only when sd revalidate disk() is called.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALSA-2025_16880

CESA-2023_2951

CVE-2022-49376

OPENSUSE-SU-2025_1263-1

RHSA-2023:2458

RHSA-2023:2951

RHSA-2023_2458

RHSA-2023_2951

SUSE-SU-2025:1027-1

SUSE-SU-2025:1176-1

SUSE-SU-2025:1183-1

SUSE-SU-2025:1194-1

SUSE-SU-2025:1241-1

SUSE-SU-2025:1263-1

SUSE-SU-2025_1027-1

SUSE-SU-2025_1241-1

SUSE-SU-2025_1263-1

Affected Products

Astra Linux

Centos

Linux Kernel

Red Hat

Suse

References · 1343

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49376.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-49376 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49376 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49376 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:1183-1 · Vendor Advisory
• https://git.kernel.org/stable/c/0fcb0b131cc90c8f523a293d84c58d0c7273c96f · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1176-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49376 · Security Note
• https://ubuntu.com/security/CVE-2022-49376 · Vendor Advisory
• https://git.kernel.org/stable/c/05fbde3a77a4f1d62e4c4428f384288c1f1a0be5 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49376 · Vendor Advisory
• https://git.kernel.org/stable/c/78f8e96df06e2d04d82d4071c299b59d28744f47 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1194-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1241-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1027-1 · Vendor Advisory