PT-2025-8619 · Linux+2 · Linux Kernel+2

Dan Vacura · Published 2022-06-21 · Updated 2025-04-14 · CVE-2022-49686

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A panic can occur in the Linux kernel due to a list double add issue in the uvcg video pump function. This happens when the endpoint becomes disabled and the uvcg video pump adds the request back to the req free list after it has already been queued to the endpoint. The endpoint complete will add the request back to the req free list, causing the issue. The problem is resolved by invalidating the local request handle once it's been queued.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Double Free

Weakness Enumeration

CWE-200

CWE-415

Related Identifiers

BDU:2026-03878

CVE-2022-49686

SUSE-SU-2025:1176-1

SUSE-SU-2025:1241-1

SUSE-SU-2025_1241-1

Affected Products

Astra Linux

Linux Kernel

Suse

References · 1301

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49686.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-49686 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-49686 · Vendor Advisory
• https://git.kernel.org/stable/c/96163f835e65f8c9897487fac965819f0651d671 · Patch
• https://git.kernel.org/stable/c/d95ac8b920de1d39525fadc408ce675697626ca6 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49686 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49686 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1241-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03878 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:1176-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-49686 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49686 · Security Note
• https://osv.dev/vulnerability/CVE-2022-49686 · Vendor Advisory
• https://suse.com/security/cve/CVE-2022-49379 · Note
• https://suse.com/security/cve/CVE-2022-49467 · Note