PT-2025-8659 · Linux+4 · Linux Kernel+4

Stephen Rothwell · Published 2022-06-08 · Updated 2025-10-24 · CVE-2022-49726

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been resolved, related to the hyper-v clocksource. The issue arises from the combination of EXPORT SYMBOL and init, which can lead to kernel panic when modules attempt to use symbols annotated init after the .init.text section is freed. The problem was previously undetected by modpost due to a decade-long bug, but after fixing modpost, the issue was identified in linux-next builds.

Recommendations Remove EXPORT SYMBOL from the hv init clocksource() function to prevent the vulnerability, as the only in-tree call-site is never compiled as modular.

Exploit

Fix

Use of Uninitialized Resource

Improper Initialization

Weakness Enumeration

CWE-908

CWE-665

Related Identifiers

BDU:2026-03714

CESA-2023_2951

CVE-2022-49726

RHSA-2023:2458

RHSA-2023:2951

RHSA-2023_2458

RHSA-2023_2951

SUSE-SU-2025:1027-1

SUSE-SU-2025:1176-1

SUSE-SU-2025:1183-1

SUSE-SU-2025:1241-1

SUSE-SU-2025_1027-1

SUSE-SU-2025_1241-1

Affected Products

Astra Linux

Centos

Linux Kernel

Red Hat

Suse

References · 1339

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49726.json · Exploit
• https://git.kernel.org/stable/c/cff3a7ce6e81418b6e8bac941779bbf5d342d626 · Patch
• https://cve.org/CVERecord?id=CVE-2022-49726 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49726 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1183-1 · Vendor Advisory
• https://git.kernel.org/stable/c/db965e2757d95f695e606856418cd84003dd036d · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1176-1 · Vendor Advisory
• https://git.kernel.org/stable/c/937fcbb55a1e48a6422e87e8f49422c92265f102 · Patch
• https://bdu.fstec.ru/vul/2026-03714 · Security Note
• https://osv.dev/vulnerability/CVE-2022-49726 · Vendor Advisory
• https://git.kernel.org/stable/c/245b993d8f6c4e25f19191edfbd8080b645e12b1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49726 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:1241-1 · Vendor Advisory
• https://git.kernel.org/stable/c/0414eab7c78f3518143d383e448d44fc573ac6d2 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1027-1 · Vendor Advisory