7.8

CVE-2022-49826: linux Double Free

CVSS: 7.8v3.1HighModified
AliasesUBUNTU-CVE-2022-49826DEBIAN-CVE-2022-49826
Published 01-05-2025Last modified 05-08-2026
Open JSON

Vulnerability summary

CVE-2022-49826 is a high (CVSS 7.8) Double Free vulnerability in linux. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 12.6% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.23%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 7 · Related 7
SUSE-SU-2025:01918-1SUSE-SU-2025:01966-1SUSE-SU-2025:01982-1SUSE-SU-2025:01983-1SUSE-SU-2025:01995-1SUSE-SU-2025:02173-1

Timeline

  1. 01-05-2025
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: ata: libata-transport: fix double ata_host_put() in ata_tport_add() In the error path in ata_tport_add(), when calling put_device(), ata_tport_release() is called, it will put the refcount of 'ap->host'. And then ata_host_put() is called again, the refcount is decreased to 0, ata_host_release() is called, all ports are freed and set to null. When unbinding the device after failure, ata_host_stop() is called to release the resources, it leads a null-ptr-deref(), because all the ports all freed and null. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 CPU: 7 PID: 18671 Comm: modprobe Kdump: loaded Tainted: G E 6.1.0-rc3+ #8 pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : ata_host_stop+0x3c/0x84 [libata] lr : release_nodes+0x64/0xd0 Call trace: ata_host_stop+0x3c/0x84 [libata] release_nodes+0x64/0xd0 devres_release_all+0xbc/0x1b0 device_unbind_cleanup+0x20/0x70 really_probe+0x158/0x320 __driver_probe_device+0x84/0x120 driver_probe_device+0x44/0x120 __driver_attach+0xb4/0x220 bus_for_each_dev+0x78/0xdc driver_attach+0x2c/0x40 bus_add_driver+0x184/0x240 driver_register+0x80/0x13c __pci_register_driver+0x4c/0x60 ahci_pci_driver_init+0x30/0x1000 [ahci] Fix this by removing redundant ata_host_put() in the error path.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.23%

Chance of exploitation in the next 30 days

Percentile

13%

Versus all other CVEs

30-day change

+0.01 pp

From 0.22% on 22-09-2026

22-09-202622-10-2026
EPSS score
0.23%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu109 products
  • linux< 5.4.0-144.161 | < 5.15.0-67.74
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 5.4.0-1097.105 | < 5.15.0-1031.35
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 2623c7a5f2799569d8bb05eb211da524a8144cb3, < 30e12e2be27ac6c4be2af4163c70db381364706f | ≥ 2623c7a5f2799569d8bb05eb211da524a8144cb3, < bec9ded5404cb14e5f5470103d0973a2ff83d6a5 | ≥ 2623c7a5f2799569d8bb05eb211da524a8144cb3, < ac471468f7c16cda2525909946ca13ddbcd14000 | ≥ 2623c7a5f2799569d8bb05eb211da524a8144cb3, < 377ff82c33c0cb74562a353361b64b33c09562cf | ≥ 2623c7a5f2799569d8bb05eb211da524a8144cb3, < 865a6da40ba092c18292ae5f6194756131293745 | ≥ 2623c7a5f2799569d8bb05eb211da524a8144cb3, < 8c76310740807ade5ecdab5888f70ecb6d35732e | 4.17
  • linux_kernel≥ 4.17, < 4.19.267 | ≥ 4.20, < 5.4.225 | ≥ 5.5, < 5.10.156 | ≥ 5.11, < 5.15.80 | ≥ 5.16, < 6.0.10 | 6.1:rc1 | 6.1:rc2 | 6.1:rc3 | 6.1:rc4
Debian1 product
  • linux< 6.0.10-1

3 vendors · 112 products

References

10 links