medium 5.5

CVE-2022-49257 json

watch_queue: Fix NULL dereference in error cleanup

published 2025-02-26 20 mo ago modified 2026-11-05 3 d ago also EUVD-2022-54969

cvss: 5.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 18%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

In watch_queue_set_size(), the error cleanup code doesn't take account of the fact that __free_page() can't handle a NULL pointer when trying to free up buffer pages that did get allocated.

Fix this by only calling __free_page() on the pages actually allocated.

Without the fix, this can lead to something like the following:

BUG: KASAN: null-ptr-deref in __free_pages+0x1f/0x1b0 mm/page_alloc.c:5473 Read of size 4 at addr 0000000000000034 by task syz-executor168/3599 ... Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 __kasan_report mm/kasan/report.c:446 [inline] kasan_report.cold+0x66/0xdf mm/kasan/report.c:459 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 instrument_atomic_read include/linux/instrumented.h:71 [inline] atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline] page_ref_count include/linux/page_ref.h:67 [inline] put_page_testzero include/linux/mm.h:717 [inline] __free_pages+0x1f/0x1b0 mm/page_alloc.c:5473 watch_queue_set_size+0x499/0x630 kernel/watch_queue.c:275 pipe_ioctl+0xac/0x2b0 fs/pipe.c:632 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae

Patch / fix

fixed in 1 distros 4 links 5

Linux Linux 5.10.110, 5.15.33, 5.16.19, 5.17.2, 5.18

debian ubuntu red hat suse

linux Debian 14, Debian 13, Debian 12 5.17.3-1

debian advisories DEBIAN-CVE-2022-49257

linux Ubuntu 22.04 LTS 5.15.0-37.39
linux-aws Ubuntu 22.04 LTS 5.15.0-1011.14
linux-gcp Ubuntu 22.04 LTS 5.15.0-1008.12
linux-gke Ubuntu 22.04 LTS 5.15.0-1008.10
linux-ibm Ubuntu 22.04 LTS 5.15.0-1007.8
linux-kvm Ubuntu 22.04 LTS 5.15.0-1010.11
linux-azure Ubuntu 22.04 LTS 5.15.0-1010.12
linux-raspi Ubuntu 22.04 LTS 5.15.0-1011.13

ubuntu advisories UBUNTU-CVE-2022-49257

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel RHEL 9 5.14.0-362.8.1.el9_3
rv RHEL 9 5.14.0-362.8.1.el9_3
perf RHEL 9 5.14.0-362.8.1.el9_3
rtla RHEL 9 5.14.0-362.8.1.el9_3
bpftool RHEL 9 7.2.0-362.8.1.el9_3
libperf RHEL 9 5.14.0-362.8.1.el9_3
kernel-rt RHEL 9 5.14.0-362.8.1.el9_3
kernel-64k RHEL 9 5.14.0-362.8.1.el9_3

red hat advisories RHSA-2023:6583

kernel-64kb SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS, SLE High Performance Computing 15 SP5-ESPOS 5.14.21-150500.55.100.1
kernel-syms SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 5.14.21-150500.55.100.1
kernel-source SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 5.14.21-150500.55.100.1
kernel-default SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +3 more 5.14.21-150500.55.100.1
kernel-obs-build SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 5.14.21-150500.55.100.1
kernel-default-base SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 5.14.21-150500.55.100.1.150500.6.47.1
kernel-rt SLE Micro 5.4, SLE Micro 5.3 5.14.21-150400.15.115.1
kernel-source-rt SLE Micro 5.4, SLE Micro 5.3 5.14.21-150400.15.115.1

suse advisories SUSE-SU-2025:1241-1 SUSE-SU-2025:1183-1 SUSE-SU-2025:1176-1 SUSE-SU-2025:1027-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-49257 updated 2026-11-06 cvss 5.5

kernel: watch_queue: Fix NULL dereference in error cleanup

Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more
affected: no fix available “Fix deferred”
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 10 kernel
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 3 d ago (2026-11-05)

Exploit prediction

0.26% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Linux Linux

Classification

Weakness

CWE-476 NULL Pointer Dereference

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2022-49257
NVD CVE-2022-49257

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary