PT-2025-8442 · Linux+3 · Linux Kernel+3

Published 2022-01-01 · Updated 2026-03-14 · CVE-2022-49509

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.15.5-00057-gaebcd29c8ed7-dirty

Description A vulnerability in the Linux kernel has been resolved, which caused a kernel oops when removing the max9286 module. The issue occurred because the I2C client data did not point to max9286 priv anymore but to v4l2 subdev. This change happened in max9286 init(), which calls v4l2 i2c subdev init() later on. The error resulted in a kernel paging request at a virtual address, leading to a level 0 translation fault.

Recommendations To resolve the issue, update the Linux kernel to a version that includes the fix for the max9286 remove() function and the necessary changes to max9286 init() and max9286 probe(). As a temporary workaround, consider avoiding the removal of the max9286 module until a patch is available.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2022-49509

SUSE-SU-2025:1027-1

SUSE-SU-2025:1176-1

SUSE-SU-2025:1183-1

SUSE-SU-2025:1241-1

SUSE-SU-2025_1027-1

SUSE-SU-2025_1241-1

Affected Products

Astra Linux

Debian

Linux Kernel

Suse

References · 1330

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49509.json · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2025:1027-1 · Vendor Advisory
• https://git.kernel.org/stable/c/9dd783274c89c21a038d967b52a858a297e767f8 · Patch
• https://git.kernel.org/stable/c/a4ec75df70575cdf33d9638c7844e729bfe6ce24 · Patch
• https://ubuntu.com/security/CVE-2022-49509 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-49509 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-49509 · Vendor Advisory
• https://git.kernel.org/stable/c/365ab7ebc24eebb42b9e020aeb440d51af8960cd · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1241-1 · Vendor Advisory
• https://git.kernel.org/stable/c/579c77595dbbdfe4f2edf335899f86ac51eca4e9 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1176-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49509 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49509 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-49509 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:1183-1 · Vendor Advisory