Linux Kernel up to 5.18.14 devm_kmalloc null pointer dereference

Summaryinfo

A vulnerability was found in Linux Kernel up to 4.19.253/5.4.207/5.10.133/5.15.57/5.18.14. It has been classified as problematic. This issue affects the function devm_kmalloc. This manipulation causes null pointer dereference. The identification of this vulnerability is CVE-2022-49608. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Linux Kernel up to 4.19.253/5.4.207/5.10.133/5.15.57/5.18.14. It has been declared as problematic. Affected by this vulnerability is the function devm_kmalloc. The manipulation with an unknown input leads to a null pointer dereference vulnerability. The CWE definition for the vulnerability is CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. As an impact it is known to affect availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: pinctrl: ralink: Check for null return of devm_kcalloc Because of the possible failure of the allocation, data->domains might be NULL pointer and will cause the dereference of the NULL pointer later. Therefore, it might be better to check it and directly return -ENOMEM without releasing data manually if fails, because the comment of the devm_kmalloc() says "Memory allocated with this function is automatically freed on driver detach.".

The advisory is shared at git.kernel.org. This vulnerability is known as CVE-2022-49608 since 02/26/2025. Technical details are known, but no exploit is available.

Upgrading to version 4.19.254, 5.4.208, 5.10.134, 5.15.58 or 5.18.15 eliminates this vulnerability. Applying the patch 13596e6c9e541e90e5fc2c52b23f08b951370da9/6194c021496addc11763d1ffa89ce5751889fe3c/5694b162f275fb9a9f89422701b2b963be11e496/44016a85419ca0d4f1e4d0127b330f8e4e2a57d0/5595d30c4dc27d939635c3188c68203b6ece1711/c3b821e8e406d5650e587b7ac624ac24e9b780a8 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 4.19.253
• 5.4.207
• 5.10.133
• 5.15.0
• 5.15.1
• 5.15.2
• 5.15.3
• 5.15.4
• 5.15.5
• 5.15.6
• 5.15.7
• 5.15.8
• 5.15.9
• 5.15.10
• 5.15.11
• 5.15.12
• 5.15.13
• 5.15.14
• 5.15.15
• 5.15.16
• 5.15.17
• 5.15.18
• 5.15.19
• 5.15.20
• 5.15.21
• 5.15.22
• 5.15.23
• 5.15.24
• 5.15.25
• 5.15.26
• 5.15.27
• 5.15.28
• 5.15.29
• 5.15.30
• 5.15.31
• 5.15.32
• 5.15.33
• 5.15.34
• 5.15.35
• 5.15.36
• 5.15.37
• 5.15.38
• 5.15.39
• 5.15.40
• 5.15.41
• 5.15.42
• 5.15.43
• 5.15.44
• 5.15.45
• 5.15.46
• 5.15.47
• 5.15.48
• 5.15.49
• 5.15.50
• 5.15.51
• 5.15.52
• 5.15.53
• 5.15.54
• 5.15.55
• 5.15.56
• 5.15.57
• 5.18.0
• 5.18.1
• 5.18.2
• 5.18.3
• 5.18.4
• 5.18.5
• 5.18.6
• 5.18.7
• 5.18.8
• 5.18.9
• 5.18.10
• 5.18.11
• 5.18.12
• 5.18.13
• 5.18.14

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion