cbcvebase.
CVE-2022-49308
published 2025-02-26

CVE-2022-49308: In the Linux kernel, the following vulnerability has been resolved: extcon: Modify extcon device to be created after driver data is set Currently, someone can…

PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.28%
20.7th percentile
In the Linux kernel, the following vulnerability has been resolved: extcon: Modify extcon device to be created after driver data is set Currently, someone can invoke the sysfs such as state_show() intermittently before dev_set_drvdata() is done. And it can be a cause of kernel Oops because of edev is Null at that time. So modified the driver registration to after setting drviver data. - Oops's backtrace. Backtrace: [] (state_show) from [] (dev_attr_show) [] (dev_attr_show) from [] (sysfs_kf_seq_show) [] (sysfs_kf_seq_show) from [] (kernfs_seq_show) [] (kernfs_seq_show) from [] (seq_read) [] (seq_read) from [] (kernfs_fop_read) [] (kernfs_fop_read) from [] (__vfs_read) [] (__vfs_read) from [] (vfs_read) [] (vfs_read) from [] (ksys_read) [] (ksys_read) from [] (sys_read) [] (sys_read) from [] (__sys_trace_return)

Affected

21 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 5.18.5-1 (bookworm)linux 5.18.5-1 (bookworm)
linuxlinux——
linuxlinux>= de55d8716ac50a356cea736c29bb7db5ac3d0190 < 6e721f3ad0535b24f19a62420f4da95212cf069c6e721f3ad0535b24f19a62420f4da95212cf069c
linuxlinux>= de55d8716ac50a356cea736c29bb7db5ac3d0190 < cb81ea998c461868d1168411a867d8ffee12f23fcb81ea998c461868d1168411a867d8ffee12f23f
linuxlinux>= de55d8716ac50a356cea736c29bb7db5ac3d0190 < d472c78cc82999d07bd09193a6718016ce9cd386d472c78cc82999d07bd09193a6718016ce9cd386
linuxlinux>= de55d8716ac50a356cea736c29bb7db5ac3d0190 < abf3b222614f49f98e606fccdd269161c0d70204abf3b222614f49f98e606fccdd269161c0d70204
linuxlinux>= de55d8716ac50a356cea736c29bb7db5ac3d0190 < 368e68ad6da4317fc4170e8d92b51c13d1bfe7a7368e68ad6da4317fc4170e8d92b51c13d1bfe7a7
linuxlinux>= de55d8716ac50a356cea736c29bb7db5ac3d0190 < 35ff1ac55d301efb3f467cf5426faaeb3452994b35ff1ac55d301efb3f467cf5426faaeb3452994b
linuxlinux>= de55d8716ac50a356cea736c29bb7db5ac3d0190 < 033ec4e7e59ae5e1ef1e8c10bc6552926044ed1c033ec4e7e59ae5e1ef1e8c10bc6552926044ed1c
linuxlinux>= de55d8716ac50a356cea736c29bb7db5ac3d0190 < 5dcc2afe716d69f5112ce035cb14f007461ff1895dcc2afe716d69f5112ce035cb14f007461ff189
linuxlinux_kernel< 4.14.2834.14.283
linuxlinux_kernel>= 0 < 5.10.127-15.10.127-1
linuxlinux_kernel>= 0 < 5.18.5-15.18.5-1
linuxlinux_kernel>= 0 < 5.18.5-15.18.5-1
linuxlinux_kernel>= 0 < 5.18.5-15.18.5-1
linuxlinux_kernel>= 4.15 < 4.19.2474.19.247
linuxlinux_kernel>= 4.20 < 5.4.1985.4.198
linuxlinux_kernel>= 5.11 < 5.15.475.15.47
linuxlinux_kernel>= 5.16 < 5.17.155.17.15
linuxlinux_kernel>= 5.18 < 5.18.45.18.4
linuxlinux_kernel>= 5.5 < 5.10.1225.10.122

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.