Log in Start free

Vulnerability · Published Feb 26, 2025 · Assigned by Linux

CVE-2022-49376scsi: sd: Fix potential NULL pointer dereference

Medium 5.5

In plain English

A medium-severity null pointer dereference in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.3%top 80.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix potential NULL pointer dereference If sd_probe() sees an early error before sdkp->device is initialized, sd_zbc_release_disk() is called. This causes a NULL pointer dereference when sd_is_zoned() is called inside that function. Avoid this by removing the call to sd_zbc_release_disk() in sd_probe() error path. This change is safe and does not result in zone information memory leakage because the zone information for a zoned disk is allocated only when sd_revalidate_disk() is called, at which point sdkp->disk_dev is fully set, resulting in sd_disk_release() being called when needed to cleanup a disk zone information using sd_zbc_release_disk().

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.18.5-1DEBIAN-CVE-2022-49376
Debian:13linux5.18.5-1DEBIAN-CVE-2022-49376
Debian:14linux5.18.5-1DEBIAN-CVE-2022-49376
Ubuntu:22.04:LTSlinux5.15.0-48.54UBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-aws5.15.0-1020.24UBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-azure5.15.0-1020.25UBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1024.30.1UBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-gcp5.15.0-1018.24UBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-gke5.15.0-1016.19UBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1003.5UBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-ibm5.15.0-1015.17UBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1016.21UBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-kvm5.15.0-1018.22UBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-48.54UBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1007.7UBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-oracle5.15.0-1018.23UBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-raspi5.15.0-1015.17UBUNTU-CVE-2022-49376
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2022-49376
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2022-49376

Affected products (as reported)

VendorProductVersions
Linux Linux 89d9475610771b5e5fe1879075f0fc9ba6e3755f – before c1f0187025905e9981000d44a92e159468b561a889d9475610771b5e5fe1879075f0fc9ba6e3755f – before 0fcb0b131cc90c8f523a293d84c58d0c7273c96f89d9475610771b5e5fe1879075f0fc9ba6e3755f – before 78f8e96df06e2d04d82d4071c299b59d28744f4789d9475610771b5e5fe1879075f0fc9ba6e3755f – before 3733439593ad12f7b54ae35c273ea6f15d692de389d9475610771b5e5fe1879075f0fc9ba6e3755f – before 05fbde3a77a4f1d62e4c4428f384288c1f1a0be5
Linux Linux 4.10

Weakness: CWE-476 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References