5.5

CVE-2022-49492: linux NULL Pointer Dereference

CVSS: 5.5v3.1MediumModified
AliasesUBUNTU-CVE-2022-49492DEBIAN-CVE-2022-49492
Published 26-02-2025Last modified 11-05-2026
Open JSON

Vulnerability summary

CVE-2022-49492 is a medium (CVSS 5.5) NULL Pointer Dereference vulnerability in linux. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.4% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.29%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 9 · Related 7
RHSA-2023:2458RHSA-2023:7077SUSE-SU-2025:03310-1SUSE-SU-2025:03384-1SUSE-SU-2025:1027-1SUSE-SU-2025:1176-1

Timeline

  1. 26-02-2025
    PublishedVulnerability first disclosed.
  2. 11-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags In nvme_alloc_admin_tags, the admin_q can be set to an error (typically -ENOMEM) if the blk_mq_init_queue call fails to set up the queue, which is checked immediately after the call. However, when we return the error message up the stack, to nvme_reset_work the error takes us to nvme_remove_dead_ctrl() nvme_dev_disable() nvme_suspend_queue(&dev->queues[0]). Here, we only check that the admin_q is non-NULL, rather than not an error or NULL, and begin quiescing a queue that never existed, leading to bad / NULL pointer dereference.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.29%

Chance of exploitation in the next 30 days

Percentile

20%

Versus all other CVEs

30-day change

0.00 pp

From 0.29% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.29%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu112 products
  • linuxAll versions (No fix recorded) | < 4.15.0-192.203 | < 5.4.0-126.142 | < 5.15.0-47.51
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 4.15.0-1140.151 | < 5.4.0-1085.92 | < 5.15.0-1019.23
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 35b489d32fcc37e8735f41aa794b24cf9d1e74f5, < 8321b17789f614414206af07e17ce4751c95dc76 | ≥ 35b489d32fcc37e8735f41aa794b24cf9d1e74f5, < 9e649471b396fa0139d53919354ce1eace9b9a24 | ≥ 35b489d32fcc37e8735f41aa794b24cf9d1e74f5, < 8da2b7bdb47e94bbc4062a3978c708926bcb022c | ≥ 35b489d32fcc37e8735f41aa794b24cf9d1e74f5, < f76729662650cd7bc8f8194e057af381370349a7 | ≥ 35b489d32fcc37e8735f41aa794b24cf9d1e74f5, < af98940dd33c9f9e1beb4f71c0a39260100e2a65 | ≥ 35b489d32fcc37e8735f41aa794b24cf9d1e74f5, < 906c81dba8ee8057523859b5e1a2479e9fd34860 | ≥ 35b489d32fcc37e8735f41aa794b24cf9d1e74f5, < 7a28556082d1fbcbc599baf1c24252dfc73efefc | ≥ 35b489d32fcc37e8735f41aa794b24cf9d1e74f5, < 54a4c1e47d1b2585e74920399455bd9abbfb2bd7 | ≥ 35b489d32fcc37e8735f41aa794b24cf9d1e74f5, < da42761181627e9bdc37d18368b827948a583929 | 3.19
  • linux_kernel< 4.9.318 | ≥ 4.10, < 4.14.283 | ≥ 4.15, < 4.19.247 | ≥ 4.20, < 5.4.198 | ≥ 5.5, < 5.10.121 | ≥ 5.11, < 5.15.46 | ≥ 5.16, < 5.17.14 | ≥ 5.18, < 5.18.3
Debian1 product
  • linux< 5.18.5-1

3 vendors · 115 products

References

13 links
Show all 13 references