CVE-2022-49945: hwmon: (gpio-fan) Fix array out of bounds access

Analyzed

AliasesUBUNTU-CVE-2022-49945DEBIAN-CVE-2022-49945

Published 18-06-2025Last modified 11-05-2026

Vulnerability summary

CVE-2022-49945 is a high (CVSS 7.1) Out-of-bounds Read vulnerability in linux. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.9% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 7.1, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.1/10

010

High · v3.1 (NVD)

EPSS score

0.24%

0%100%

Low · +0.01 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6 · Related 6

SUSE-SU-2025:02264-1 SUSE-SU-2025:02308-1 SUSE-SU-2025:02320-1 SUSE-SU-2025:02321-1 SUSE-SU-2025:02322-1 SUSE-SU-2025:02537-1

Timeline

18-06-2025
PublishedVulnerability first disclosed.
11-05-2026
Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: hwmon: (gpio-fan) Fix array out of bounds access The driver does not check if the cooling state passed to gpio_fan_set_cur_state() exceeds the maximum cooling state as stored in fan_data->num_speeds. Since the cooling state is later used as an array index in set_fan_speed(), an array out of bounds access can occur. This can be exploited by setting the state of the thermal cooling device to arbitrary values, causing for example a kernel oops when unavailable memory is accessed this way. Example kernel oops: [ 807.987276] Unable to handle kernel paging request at virtual address ffffff80d0588064 [ 807.987369] Mem abort info: [ 807.987398] ESR = 0x96000005 [ 807.987428] EC = 0x25: DABT (current EL), IL = 32 bits [ 807.987477] SET = 0, FnV = 0 [ 807.987507] EA = 0, S1PTW = 0 [ 807.987536] FSC = 0x05: level 1 translation fault [ 807.987570] Data abort info: [ 807.987763] ISV = 0, ISS = 0x00000005 [ 807.987801] CM = 0, WnR = 0 [ 807.987832] swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000001165000 [ 807.987872] [ffffff80d0588064] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [ 807.987961] Internal error: Oops: 96000005 [#1] PREEMPT SMP [ 807.987992] Modules linked in: cmac algif_hash aes_arm64 algif_skcipher af_alg bnep hci_uart btbcm bluetooth ecdh_generic ecc 8021q garp stp llc snd_soc_hdmi_codec brcmfmac vc4 brcmutil cec drm_kms_helper snd_soc_core cfg80211 snd_compress bcm2835_codec(C) snd_pcm_dmaengine syscopyarea bcm2835_isp(C) bcm2835_v4l2(C) sysfillrect v4l2_mem2mem bcm2835_mmal_vchiq(C) raspberrypi_hwmon sysimgblt videobuf2_dma_contig videobuf2_vmalloc fb_sys_fops videobuf2_memops rfkill videobuf2_v4l2 videobuf2_common i2c_bcm2835 snd_bcm2835(C) videodev snd_pcm snd_timer snd mc vc_sm_cma(C) gpio_fan uio_pdrv_genirq uio drm fuse drm_panel_orientation_quirks backlight ip_tables x_tables ipv6 [ 807.988508] CPU: 0 PID: 1321 Comm: bash Tainted: G C 5.15.56-v8+ #1575 [ 807.988548] Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT) [ 807.988574] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 807.988608] pc : set_fan_speed.part.5+0x34/0x80 [gpio_fan] [ 807.988654] lr : gpio_fan_set_cur_state+0x34/0x50 [gpio_fan] [ 807.988691] sp : ffffffc008cf3bd0 [ 807.988710] x29: ffffffc008cf3bd0 x28: ffffff80019edac0 x27: 0000000000000000 [ 807.988762] x26: 0000000000000000 x25: 0000000000000000 x24: ffffff800747c920 [ 807.988787] x23: 000000000000000a x22: ffffff800369f000 x21: 000000001999997c [ 807.988854] x20: ffffff800369f2e8 x19: ffffff8002ae8080 x18: 0000000000000000 [ 807.988877] x17: 0000000000000000 x16: 0000000000000000 x15: 000000559e271b70 [ 807.988938] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [ 807.988960] x11: 0000000000000000 x10: ffffffc008cf3c20 x9 : ffffffcfb60c741c [ 807.989018] x8 : 000000000000000a x7 : 00000000ffffffc9 x6 : 0000000000000009 [ 807.989040] x5 : 000000000000002a x4 : 0000000000000000 x3 : ffffff800369f2e8 [ 807.989062] x2 : 000000000000e780 x1 : 0000000000000001 x0 : ffffff80d0588060 [ 807.989084] Call trace: [ 807.989091] set_fan_speed.part.5+0x34/0x80 [gpio_fan] [ 807.989113] gpio_fan_set_cur_state+0x34/0x50 [gpio_fan] [ 807.989199] cur_state_store+0x84/0xd0 [ 807.989221] dev_attr_store+0x20/0x38 [ 807.989262] sysfs_kf_write+0x4c/0x60 [ 807.989282] kernfs_fop_write_iter+0x130/0x1c0 [ 807.989298] new_sync_write+0x10c/0x190 [ 807.989315] vfs_write+0x254/0x378 [ 807.989362] ksys_write+0x70/0xf8 [ 807.989379] __arm64_sys_write+0x24/0x30 [ 807.989424] invoke_syscall+0x4c/0x110 [ 807.989442] el0_svc_common.constprop.3+0xfc/0x120 [ 807.989458] do_el0_svc+0x2c/0x90 [ 807.989473] el0_svc+0x24/0x60 [ 807.989544] el0t_64_sync_handler+0x90/0xb8 [ 807.989558] el0t_64_sync+0x1a0/0x1a4 [ 807.989579] Code: b9403801 f9402800 7100003f 8b35cc00 (b9400416) [ 807.989627] ---[ end t ---truncated---

CVSS metrics

3 scores · 3 sources · 1 version

v3.17.1

EPSS trend

Probability

0.24%

Chance of exploitation in the next 30 days

Percentile

15%

Versus all other CVEs

30-day change

Increase +0.01 pp

From 0.23% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu111 products

linuxAll versions (No fix recorded) | < 4.15.0-201.212 | < 5.4.0-136.153 | < 5.15.0-57.63
linux-allwinner-5.19All versions (No fix recorded)
linux-awsAll versions (No fix recorded) | < 4.15.0-1147.159 | < 5.4.0-1093.101 | < 5.15.0-1027.31
linux-aws-5.0All versions (No fix recorded)
linux-aws-5.11All versions (No fix recorded)

linux-aws-5.13All versions (No fix recorded)
linux-aws-5.15< 5.15.0-1027.31~20.04.1
linux-aws-5.19All versions (No fix recorded)
linux-aws-5.3All versions (No fix recorded)
linux-aws-5.4< 5.4.0-1093.102~18.04.2
linux-aws-5.8All versions (No fix recorded)
linux-aws-6.2All versions (No fix recorded)
linux-aws-6.5All versions (No fix recorded)
linux-aws-fips< 4.15.0-2087.93 | All versions (No fix recorded) | < 5.4.0-1093.101+fips1
linux-aws-hwe< 4.15.0-1147.159~16.04.1
linux-azure< 4.15.0-1158.173~14.04.1 | < 4.15.0-1159.174~16.04.1 | All versions (No fix recorded) | < 5.4.0-1100.106 | < 5.15.0-1030.37
linux-azure-4.15< 4.15.0-1158.173
linux-azure-5.11All versions (No fix recorded)
linux-azure-5.13All versions (No fix recorded)
linux-azure-5.15< 5.15.0-1030.37~20.04.1
linux-azure-5.19All versions (No fix recorded)
linux-azure-5.3All versions (No fix recorded)
linux-azure-5.4< 5.4.0-1100.106~18.04.1
linux-azure-5.8All versions (No fix recorded)
linux-azure-6.2All versions (No fix recorded)
linux-azure-6.5All versions (No fix recorded)
linux-azure-edgeAll versions (No fix recorded)
linux-azure-fdeAll versions (No fix recorded) | < 5.15.0-1030.37.1
linux-azure-fde-5.19All versions (No fix recorded)
linux-azure-fde-6.2All versions (No fix recorded)
linux-azure-fips< 4.15.0-2067.73 | All versions (No fix recorded) | < 5.4.0-1100.106+fips1
linux-bluefield< 5.4.0-1054.60
linux-fipsAll versions (No fix recorded) | < 4.15.0-1104.115 | < 5.4.0-1069.78
linux-gcp< 4.15.0-1142.158~16.04.1 | All versions (No fix recorded) | < 5.4.0-1097.106 | < 5.15.0-1026.33
linux-gcp-4.15< 4.15.0-1142.158
linux-gcp-5.11All versions (No fix recorded)
linux-gcp-5.13All versions (No fix recorded)
linux-gcp-5.15< 5.15.0-1027.34~20.04.1
linux-gcp-5.19All versions (No fix recorded)
linux-gcp-5.3All versions (No fix recorded)
linux-gcp-5.4< 5.4.0-1097.106~18.04.1
linux-gcp-5.8All versions (No fix recorded)
linux-gcp-6.2All versions (No fix recorded)
linux-gcp-6.5All versions (No fix recorded)
linux-gcp-fips< 4.15.0-2052.57 | All versions (No fix recorded) | < 5.4.0-1097.106+fips1
linux-gkeAll versions (No fix recorded) | < 5.15.0-1024.29
linux-gke-4.15All versions (No fix recorded)
linux-gke-5.15All versions (No fix recorded)
linux-gke-5.4All versions (No fix recorded)
linux-gkeopAll versions (No fix recorded) | < 5.15.0-1012.16
linux-gkeop-5.15All versions (No fix recorded)
linux-gkeop-5.4All versions (No fix recorded)
linux-hwe< 4.15.0-201.212~16.04.1 | All versions (No fix recorded)
linux-hwe-5.11All versions (No fix recorded)
linux-hwe-5.13All versions (No fix recorded)
linux-hwe-5.15< 5.15.0-57.63~20.04.1
linux-hwe-5.19All versions (No fix recorded)
linux-hwe-5.4< 5.4.0-136.153~18.04.1
linux-hwe-5.8All versions (No fix recorded)
linux-hwe-6.2All versions (No fix recorded)
linux-hwe-6.5All versions (No fix recorded)
linux-hwe-edgeAll versions (No fix recorded)
linux-ibm< 5.4.0-1041.46 | < 5.15.0-1022.25
linux-ibm-5.4< 5.4.0-1041.46~18.04.1
linux-intel-5.13All versions (No fix recorded)
linux-intel-iot-realtimeAll versions (No fix recorded)
linux-intel-iotg< 5.15.0-1023.28
linux-intel-iotg-5.15< 5.15.0-1023.28~20.04.1
linux-iot< 5.4.0-1010.12
linux-kvmAll versions (No fix recorded) | < 4.15.0-1133.138 | < 5.4.0-1083.89 | < 5.15.0-1025.30
linux-lowlatency< 5.15.0-57.63
linux-lowlatency-hwe-5.15< 5.15.0-58.64~20.04.1
linux-lowlatency-hwe-5.19All versions (No fix recorded)
linux-lowlatency-hwe-6.2All versions (No fix recorded)
linux-lowlatency-hwe-6.5All versions (No fix recorded)
linux-lts-xenialAll versions (No fix recorded)
linux-nvidia< 5.15.0-1015.15
linux-nvidia-6.2All versions (No fix recorded)
linux-nvidia-6.5All versions (No fix recorded)
linux-oemAll versions (No fix recorded)
linux-oem-5.10All versions (No fix recorded)
linux-oem-5.13All versions (No fix recorded)
linux-oem-5.14All versions (No fix recorded)
linux-oem-5.17All versions (No fix recorded)
linux-oem-5.6All versions (No fix recorded)
linux-oem-6.0All versions (No fix recorded)
linux-oem-6.1All versions (No fix recorded)
linux-oem-6.5All versions (No fix recorded)
linux-oracle< 4.15.0-1112.123~16.04.1 | < 4.15.0-1112.123 | < 5.4.0-1091.100 | < 5.15.0-1026.32
linux-oracle-5.0All versions (No fix recorded)
linux-oracle-5.11All versions (No fix recorded)
linux-oracle-5.13All versions (No fix recorded)
linux-oracle-5.15< 5.15.0-1027.33~20.04.1
linux-oracle-5.3All versions (No fix recorded)
linux-oracle-5.4< 5.4.0-1091.100~18.04.1
linux-oracle-5.8All versions (No fix recorded)
linux-oracle-6.5All versions (No fix recorded)
linux-raspi< 5.4.0-1078.89 | < 5.15.0-1022.24
linux-raspi-5.4< 5.4.0-1078.89~18.04.1
linux-raspi-realtimeAll versions (No fix recorded)
linux-raspi2All versions (No fix recorded)
linux-realtimeAll versions (No fix recorded) | < 5.15.0-1029.32
linux-riscvAll versions (No fix recorded)
linux-riscv-5.11All versions (No fix recorded)
linux-riscv-5.15< 5.15.0-1027.31~20.04.1
linux-riscv-5.19All versions (No fix recorded)
linux-riscv-5.8All versions (No fix recorded)
linux-riscv-6.5All versions (No fix recorded)
linux-starfive-5.19All versions (No fix recorded)
linux-starfive-6.2All versions (No fix recorded)
linux-starfive-6.5All versions (No fix recorded)

Show all 111

Linux2 products

linux≥ b5cf88e46badea6d600d8515edea23814e03444d, < e9f6972ab40a82bd7f6d36800792ba2e084474d8 | ≥ b5cf88e46badea6d600d8515edea23814e03444d, < 3ff866455e1e263a9ac1958095fd440984248e2f | ≥ b5cf88e46badea6d600d8515edea23814e03444d, < c8ae6a18708f260ccdeef6ba53af7548457dc26c | ≥ b5cf88e46badea6d600d8515edea23814e03444d, < 7756eb1ed124753f4d64f761fc3d84290dffcb4d | ≥ b5cf88e46badea6d600d8515edea23814e03444d, < 517dba798793e69b510779c3cde7224a65f3ed1d | ≥ b5cf88e46badea6d600d8515edea23814e03444d, < 53196e0376205ed49b75bfd0475af5e0fbd20156 | ≥ b5cf88e46badea6d600d8515edea23814e03444d, < 3263984c7acdcb0658155b05a724ed45a10de76d | ≥ b5cf88e46badea6d600d8515edea23814e03444d, < f233d2be38dbbb22299192292983037f01ab363c | 4.1
linux_kernel≥ 4.1, < 4.9.328 | ≥ 4.10, < 4.14.293 | ≥ 4.15, < 4.19.258 | ≥ 4.20, < 5.4.213 | ≥ 5.5, < 5.10.142 | ≥ 5.11, < 5.15.66 | ≥ 5.16, < 5.19.8 | 6.0:rc1 | 6.0:rc2 | 6.0:rc3

Debian1 product

linux< 6.0.2-1

3 vendors · 114 products

References

11 links

git.kernel.org/stable/c/e9f6972ab40a82bd7f6d36800792ba2e084474d8REPORTPatch
git.kernel.org/stable/c/3ff866455e1e263a9ac1958095fd440984248e2fREPORTPatch
git.kernel.org/stable/c/c8ae6a18708f260ccdeef6ba53af7548457dc26cREPORTPatch
git.kernel.org/stable/c/7756eb1ed124753f4d64f761fc3d84290dffcb4dREPORTPatch
git.kernel.org/stable/c/517dba798793e69b510779c3cde7224a65f3ed1dREPORTPatch
git.kernel.org/stable/c/53196e0376205ed49b75bfd0475af5e0fbd20156REPORTPatch
git.kernel.org/stable/c/3263984c7acdcb0658155b05a724ed45a10de76dREPORTPatch
git.kernel.org/stable/c/f233d2be38dbbb22299192292983037f01ab363cREPORTPatch
ubuntu.com/security/CVE-2022-49945REPORT
www.cve.org/CVERecord?id=CVE-2022-49945REPORT

Show all 11 references

security-tracker.debian.org/tracker/CVE-2022-49945Advisory