CVE-2022-49410
published 2025-02-26CVE-2022-49410: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential double free in create_var_ref() In create_var_ref(), init_var_ref()…
PriorityP336high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.30%
22.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix potential double free in create_var_ref()
In create_var_ref(), init_var_ref() is called to initialize the fields
of variable ref_field, which is allocated in the previous function call
to create_hist_field(). Function init_var_ref() allocates the
corresponding fields such as ref_field->system, but frees these fields
when the function encounters an error. The caller later calls
destroy_hist_field() to conduct error handling, which frees the fields
and the variable itself. This results in double free of the fields which
are already freed in the previous function.
Fix this by storing NULL to the corresponding fields when they are freed
in init_var_ref().
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.18.5-1 (bookworm) | linux 5.18.5-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 067fe038e70f6e64960d26a79c4df5f1413d0f13 < f8b383f83cb573152c577eca1ef101e89995b72a | f8b383f83cb573152c577eca1ef101e89995b72a |
| linux | linux | >= 067fe038e70f6e64960d26a79c4df5f1413d0f13 < c27f744ceefadc7bbeb14233b6abc150ced617d2 | c27f744ceefadc7bbeb14233b6abc150ced617d2 |
| linux | linux | >= 067fe038e70f6e64960d26a79c4df5f1413d0f13 < 058cb6d86b9789377216c936506b346aaa1eb581 | 058cb6d86b9789377216c936506b346aaa1eb581 |
| linux | linux | >= 067fe038e70f6e64960d26a79c4df5f1413d0f13 < 37443b3508b8cce6832f8d25cb4550b2f7801f50 | 37443b3508b8cce6832f8d25cb4550b2f7801f50 |
| linux | linux | >= 067fe038e70f6e64960d26a79c4df5f1413d0f13 < 4fdfb15e08598711dbf50daf56a33965232daf0e | 4fdfb15e08598711dbf50daf56a33965232daf0e |
| linux | linux | >= 067fe038e70f6e64960d26a79c4df5f1413d0f13 < bd83ff3bbfb003832481c9bff999d12385f396ae | bd83ff3bbfb003832481c9bff999d12385f396ae |
| linux | linux | >= 067fe038e70f6e64960d26a79c4df5f1413d0f13 < 99696a2592bca641eb88cc9a80c90e591afebd0f | 99696a2592bca641eb88cc9a80c90e591afebd0f |
| linux | linux_kernel | >= 0 < 5.10.127-1 | 5.10.127-1 |
| linux | linux_kernel | >= 0 < 5.18.5-1 | 5.18.5-1 |
| linux | linux_kernel | >= 0 < 5.18.5-1 | 5.18.5-1 |
| linux | linux_kernel | >= 0 < 5.18.5-1 | 5.18.5-1 |
| linux | linux_kernel | >= 4.17 < 4.19.247 | 4.19.247 |
| linux | linux_kernel | >= 4.20 < 5.4.198 | 5.4.198 |
| linux | linux_kernel | >= 5.11 < 5.15.46 | 5.15.46 |
| linux | linux_kernel | >= 5.16 < 5.17.14 | 5.17.14 |
| linux | linux_kernel | >= 5.18 < 5.18.3 | 5.18.3 |
| linux | linux_kernel | >= 5.5 < 5.10.121 | 5.10.121 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: tracing: Fix potential double free in create_var_ref()
vendor_redhat·2025-02-26·CVSS 7.8
CVE-2022-49410 [HIGH] CWE-415 kernel: tracing: Fix potential double free in create_var_ref()
kernel: tracing: Fix potential double free in create_var_ref()
In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix potential double free in create_var_ref()
In create_var_ref(), init_var_ref() is called to initialize the fields
of variable ref_field, which is allocated in the previous function call
to create_hist_field(). Function init_var_ref() allocates the
corresponding fields such as ref_field->system, but frees these fields
when the function encounters an error. The caller later calls
destroy_hist_field() to conduct error handling, which frees the fields
and the variable itself. This results in double free of the fields which
are already freed in the previous function.
Fix this by storing NULL to the corresponding fields when they are freed
in init_var_re
Debian
CVE-2022-49410: linux - In the Linux kernel, the following vulnerability has been resolved: tracing: Fi...
vendor_debian·2022·CVSS 7.8
CVE-2022-49410 [HIGH] CVE-2022-49410: linux - In the Linux kernel, the following vulnerability has been resolved: tracing: Fi...
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential double free in create_var_ref() In create_var_ref(), init_var_ref() is called to initialize the fields of variable ref_field, which is allocated in the previous function call to create_hist_field(). Function init_var_ref() allocates the corresponding fields such as ref_field->system, but frees these fields when the function encounters an error. The caller later calls destroy_hist_field() to conduct error handling, which frees the fields and the variable itself. This results in double free of the fields which are already freed in the previous function. Fix this by storing NULL to the corresponding fields when they are freed in init_var_ref().
Scope: local
bookworm: resolved (fixed in 5.18.5-1)
bullsey
GHSA
GHSA-7vw9-hmx7-h29g: In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix potential double free in create_var_ref()
In create_var_ref(), init
ghsa_unreviewed·2025-04-17
CVE-2022-49410 [HIGH] CWE-415 GHSA-7vw9-hmx7-h29g: In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix potential double free in create_var_ref()
In create_var_ref(), init
In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix potential double free in create_var_ref()
In create_var_ref(), init_var_ref() is called to initialize the fields
of variable ref_field, which is allocated in the previous function call
to create_hist_field(). Function init_var_ref() allocates the
corresponding fields such as ref_field->system, but frees these fields
when the function encounters an error. The caller later calls
destroy_hist_field() to conduct error handling, which frees the fields
and the variable itself. This results in double free of the fields which
are already freed in the previous function.
Fix this by storing NULL to the corresponding fields when they are freed
in init_var_ref().
OSV
CVE-2022-49410: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential double free in create_var_ref() In create_var_ref(), init_v
osv·2025-02-26·CVSS 7.8
CVE-2022-49410 [HIGH] CVE-2022-49410: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential double free in create_var_ref() In create_var_ref(), init_v
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential double free in create_var_ref() In create_var_ref(), init_var_ref() is called to initialize the fields of variable ref_field, which is allocated in the previous function call to create_hist_field(). Function init_var_ref() allocates the corresponding fields such as ref_field->system, but frees these fields when the function encounters an error. The caller later calls destroy_hist_field() to conduct error handling, which frees the fields and the variable itself. This results in double free of the fields which are already freed in the previous function. Fix this by storing NULL to the corresponding fields when they are freed in init_var_ref().
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/058cb6d86b9789377216c936506b346aaa1eb581https://git.kernel.org/stable/c/37443b3508b8cce6832f8d25cb4550b2f7801f50https://git.kernel.org/stable/c/4fdfb15e08598711dbf50daf56a33965232daf0ehttps://git.kernel.org/stable/c/99696a2592bca641eb88cc9a80c90e591afebd0fhttps://git.kernel.org/stable/c/bd83ff3bbfb003832481c9bff999d12385f396aehttps://git.kernel.org/stable/c/c27f744ceefadc7bbeb14233b6abc150ced617d2https://git.kernel.org/stable/c/f8b383f83cb573152c577eca1ef101e89995b72a
2025-02-26
Published