PT-2025-8358 · Linux+2 · Linux Kernel+2

Miles Chen · Published 2022-05-13 · Updated 2025-04-14 · CVE-2022-49424

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference issue has been identified in the Linux kernel, specifically in the iommu/mediatek module. This issue occurs when the larbdev is NULL, causing the device link add() function to fail and resulting in a kernel crash when attempting to print dev name(larbdev). The error log indicates a NULL pointer dereference at a virtual address, leading to a kernel crash. The issue is related to an incorrect setting in the device tree, where the node is incorrectly set to iommus = <&iommu NUM>, causing the larbdev to be NULL.

Recommendations To resolve this issue, it is recommended to update the Linux kernel to a version that includes the fix for this issue. As a temporary workaround, consider disabling the vulnerable iommu/mediatek module until a patch is available. Additionally, ensure that the device tree settings are correct, and the iommus node is properly configured to avoid invalid inputs.

Exploit

Fix

Improper Resource Release

NULL Pointer Dereference

Weakness Enumeration

CWE-404

CWE-476

Related Identifiers

BDU:2026-04032

CVE-2022-49424

SUSE-SU-2025:1027-1

SUSE-SU-2025:1176-1

SUSE-SU-2025:1183-1

SUSE-SU-2025:1241-1

SUSE-SU-2025_1027-1

SUSE-SU-2025_1241-1

Affected Products

Astra Linux

Linux Kernel

Suse

References · 1333

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49424.json · Exploit
• https://git.kernel.org/stable/c/8837c2682b9b2eed83e6212bcf79850c593a6fee · Patch
• https://cve.org/CVERecord?id=CVE-2022-49424 · Security Note
• https://git.kernel.org/stable/c/e9c63c0f73a1bbfd02624f5eae7e881df8b6830f · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1027-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49424 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49424 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49424 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1241-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1176-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-49424 · Vendor Advisory
• https://git.kernel.org/stable/c/c3c2734e28d7fac50228c4d2b8896e8695adf304 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1183-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04032 · Security Note
• https://ubuntu.com/security/CVE-2022-49424 · Vendor Advisory