Linux Kernel up to 5.17.0 tpm-space.c try_get_ops tpm_mutex null pointer dereference

Summaryinfo

A vulnerability was found in Linux Kernel up to 5.4.187/5.10.108/5.15.31/5.16.17/5.17.0. It has been declared as problematic. This issue affects the function try_get_ops of the file tpm-space.c. The manipulation of the argument tpm_mutex results in an unknown weakness. This vulnerability is identified as CVE-2022-49286. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Linux Kernel up to 5.4.187/5.10.108/5.15.31/5.16.17/5.17.0. Affected is the function try_get_ops of the file tpm-space.c. The manipulation of the argument tpm_mutex with an unknown input leads to a unknown weakness. CWE is classifying the issue as CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. The impact remains unknown. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: tpm: use try_get_ops() in tpm-space.c As part of the series conversion to remove nested TPM operations: https://lore.kernel.org/all/[email protected]/ exposure of the chip->tpm_mutex was removed from much of the upper level code. In this conversion, tpm2_del_space() was missed. This didn't matter much because it's usually called closely after a converted operation, so there's only a very tiny race window where the chip can be removed before the space flushing is done which causes a NULL deref on the mutex. However, there are reports of this window being hit in practice, so fix this by converting tpm2_del_space() to use tpm_try_get_ops(), which performs all the teardown checks before acquring the mutex.

The advisory is shared for download at git.kernel.org. This vulnerability is traded as CVE-2022-49286 since 02/26/2025. The exploitability is told to be difficult. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 234545 (SUSE SLES12 Security Update : kernel (SUSE-SU-2025:1293-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.4.188, 5.10.109, 5.15.32, 5.16.18 or 5.17.1 eliminates this vulnerability. Applying the patch 5b1d2561a03e534064b51c50c774657833d3d2cf/95193d12f10a8a088843b25e0f5fe1d83ec6b079/476ddd23f818fb94cf86fb5617f3bb9a7c92113d/eda1662cce964c8a65bb86321f8d9cfa6e9ceaab/ba84f9a48366dcc3cdef978599433efe101dd5bd/fb5abce6b2bb5cb3d628aaa63fa821da8c4600f9 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (234545) and CERT Bund (WID-SEC-2025-2107). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Google Container-Optimized OS
• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• Open Source Linux Kernel
• RESF Rocky Linux
• Dell Secure Connect Gateway
• IBM QRadar SIEM
• Dell NetWorker

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.4.187
• 5.5
• 5.6
• 5.7
• 5.8
• 5.9
• 5.10
• 5.10.108
• 5.11
• 5.12
• 5.13
• 5.14
• 5.15
• 5.15.0
• 5.15.1
• 5.15.2
• 5.15.3
• 5.15.4
• 5.15.5
• 5.15.6
• 5.15.7
• 5.15.8
• 5.15.9
• 5.15.10
• 5.15.11
• 5.15.12
• 5.15.13
• 5.15.14
• 5.15.15
• 5.15.16
• 5.15.17
• 5.15.18
• 5.15.19
• 5.15.20
• 5.15.21
• 5.15.22
• 5.15.23
• 5.15.24
• 5.15.25
• 5.15.26
• 5.15.27
• 5.15.28
• 5.15.29
• 5.15.30
• 5.15.31
• 5.16
• 5.16.0
• 5.16.1
• 5.16.2
• 5.16.3
• 5.16.4
• 5.16.5
• 5.16.6
• 5.16.7
• 5.16.8
• 5.16.9
• 5.16.10
• 5.16.11
• 5.16.12
• 5.16.13
• 5.16.14
• 5.16.15
• 5.16.16
• 5.16.17
• 5.17.0

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion