7.5

CVE-2022-49928: linux NULL Pointer Dereference

CVSS: 7.5v3.1HighModified
AliasesUBUNTU-CVE-2022-49928DEBIAN-CVE-2022-49928
Published 01-05-2025Last modified 05-08-2026
Open JSON

Vulnerability summary

CVE-2022-49928 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in linux. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.1% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.36%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 4
SUSE-SU-2025:01918-1SUSE-SU-2025:01966-1SUSE-SU-2025:02173-1SUSE-SU-2025:02262-1

Timeline

  1. 01-05-2025
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix null-ptr-deref when xps sysfs alloc failed There is a null-ptr-deref when xps sysfs alloc failed: BUG: KASAN: null-ptr-deref in sysfs_do_create_link_sd+0x40/0xd0 Read of size 8 at addr 0000000000000030 by task gssproxy/457 CPU: 5 PID: 457 Comm: gssproxy Not tainted 6.0.0-09040-g02357b27ee03 #9 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 kasan_report+0xa3/0x120 sysfs_do_create_link_sd+0x40/0xd0 rpc_sysfs_client_setup+0x161/0x1b0 rpc_new_client+0x3fc/0x6e0 rpc_create_xprt+0x71/0x220 rpc_create+0x1d4/0x350 gssp_rpc_create+0xc3/0x160 set_gssp_clnt+0xbc/0x140 write_gssp+0x116/0x1a0 proc_reg_write+0xd6/0x130 vfs_write+0x177/0x690 ksys_write+0xb9/0x150 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 When the xprt_switch sysfs alloc failed, should not add xprt and switch sysfs to it, otherwise, maybe null-ptr-deref; also initialize the 'xps_sysfs' to NULL to avoid oops when destroy it.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.36%

Chance of exploitation in the next 30 days

Percentile

28%

Versus all other CVEs

30-day change

+0.01 pp

From 0.34% on 22-09-2026

22-09-202622-10-2026
EPSS score
0.36%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu95 products
  • linux< 5.15.0-60.66
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 5.15.0-1030.34
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ baea99445dd4675a834e8a5987d2f368adb62e6c, < d59722d088a9d86ce6d9d39979e5d1d669d249f7 | ≥ baea99445dd4675a834e8a5987d2f368adb62e6c, < 7b189b0aa8dab14b49c31c65af8a982e96e25b62 | ≥ baea99445dd4675a834e8a5987d2f368adb62e6c, < cbdeaee94a415800c65a8c3fa04d9664a8b8fb3a | 5.14
  • linux_kernel≥ 5.14, < 5.15.78 | ≥ 5.16, < 6.0.8 | 6.1:rc1 | 6.1:rc2 | 6.1:rc3
Debian1 product
  • linux< 6.0.8-1

3 vendors · 98 products

References

7 links