CVE-2022-49826
published 2025-05-01CVE-2022-49826: In the Linux kernel, the following vulnerability has been resolved: ata: libata-transport: fix double ata_host_put() in ata_tport_add() In the error path in…
PriorityP336high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.22%
12.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
ata: libata-transport: fix double ata_host_put() in ata_tport_add()
In the error path in ata_tport_add(), when calling put_device(),
ata_tport_release() is called, it will put the refcount of 'ap->host'.
And then ata_host_put() is called again, the refcount is decreased
to 0, ata_host_release() is called, all ports are freed and set to
null.
When unbinding the device after failure, ata_host_stop() is called
to release the resources, it leads a null-ptr-deref(), because all
the ports all freed and null.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
CPU: 7 PID: 18671 Comm: modprobe Kdump: loaded Tainted: G E 6.1.0-rc3+ #8
pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : ata_host_stop+0x3c/0x84 [libata]
lr : release_nodes+0x64/0xd0
Call trace:
ata_host_stop+0x3c/0x84 [libata]
release_nodes+0x64/0xd0
devres_release_all+0xbc/0x1b0
device_unbind_cleanup+0x20/0x70
really_probe+0x158/0x320
__driver_probe_device+0x84/0x120
driver_probe_device+0x44/0x120
__driver_attach+0xb4/0x220
bus_for_each_dev+0x78/0xdc
driver_attach+0x2c/0x40
bus_add_driver+0x184/0x240
driver_register+0x80/0x13c
__pci_register_driver+0x4c/0x60
ahci_pci_driver_init+0x30/0x1000 [ahci]
Fix this by removing redundant ata_host_put() in the error path.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.10-1 (bookworm) | linux 6.0.10-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 2623c7a5f2799569d8bb05eb211da524a8144cb3 < 30e12e2be27ac6c4be2af4163c70db381364706f | 30e12e2be27ac6c4be2af4163c70db381364706f |
| linux | linux | >= 2623c7a5f2799569d8bb05eb211da524a8144cb3 < bec9ded5404cb14e5f5470103d0973a2ff83d6a5 | bec9ded5404cb14e5f5470103d0973a2ff83d6a5 |
| linux | linux | >= 2623c7a5f2799569d8bb05eb211da524a8144cb3 < ac471468f7c16cda2525909946ca13ddbcd14000 | ac471468f7c16cda2525909946ca13ddbcd14000 |
| linux | linux | >= 2623c7a5f2799569d8bb05eb211da524a8144cb3 < 377ff82c33c0cb74562a353361b64b33c09562cf | 377ff82c33c0cb74562a353361b64b33c09562cf |
| linux | linux | >= 2623c7a5f2799569d8bb05eb211da524a8144cb3 < 865a6da40ba092c18292ae5f6194756131293745 | 865a6da40ba092c18292ae5f6194756131293745 |
| linux | linux | >= 2623c7a5f2799569d8bb05eb211da524a8144cb3 < 8c76310740807ade5ecdab5888f70ecb6d35732e | 8c76310740807ade5ecdab5888f70ecb6d35732e |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.158-1 | 5.10.158-1 |
| linux | linux_kernel | >= 0 < 6.0.10-1 | 6.0.10-1 |
| linux | linux_kernel | >= 0 < 6.0.10-1 | 6.0.10-1 |
| linux | linux_kernel | >= 0 < 6.0.10-1 | 6.0.10-1 |
| linux | linux_kernel | >= 4.17 < 4.19.267 | 4.19.267 |
| linux | linux_kernel | >= 4.20 < 5.4.225 | 5.4.225 |
| linux | linux_kernel | >= 5.11 < 5.15.80 | 5.15.80 |
| linux | linux_kernel | >= 5.16 < 6.0.10 | 6.0.10 |
| linux | linux_kernel | >= 5.5 < 5.10.156 | 5.10.156 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2022-49826: In the Linux kernel, the following vulnerability has been resolved: ata: libata-transport: fix double ata_host_put() in ata_tport_add() In the error p
osv·2025-05-01·CVSS 7.8
CVE-2022-49826 [HIGH] CVE-2022-49826: In the Linux kernel, the following vulnerability has been resolved: ata: libata-transport: fix double ata_host_put() in ata_tport_add() In the error p
In the Linux kernel, the following vulnerability has been resolved: ata: libata-transport: fix double ata_host_put() in ata_tport_add() In the error path in ata_tport_add(), when calling put_device(), ata_tport_release() is called, it will put the refcount of 'ap->host'. And then ata_host_put() is called again, the refcount is decreased to 0, ata_host_release() is called, all ports are freed and set to null. When unbinding the device after failure, ata_host_stop() is called to release the resources, it leads a null-ptr-deref(), because all the ports all freed and null. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 CPU: 7 PID: 18671 Comm: modprobe Kdump: loaded Tainted: G E 6.1.0-rc3+ #8 pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) p
GHSA
GHSA-56f2-3g4j-6qjh: In the Linux kernel, the following vulnerability has been resolved:
ata: libata-transport: fix double ata_host_put() in ata_tport_add()
In the error
ghsa_unreviewed·2025-05-01
CVE-2022-49826 [HIGH] CWE-415 GHSA-56f2-3g4j-6qjh: In the Linux kernel, the following vulnerability has been resolved:
ata: libata-transport: fix double ata_host_put() in ata_tport_add()
In the error
In the Linux kernel, the following vulnerability has been resolved:
ata: libata-transport: fix double ata_host_put() in ata_tport_add()
In the error path in ata_tport_add(), when calling put_device(),
ata_tport_release() is called, it will put the refcount of 'ap->host'.
And then ata_host_put() is called again, the refcount is decreased
to 0, ata_host_release() is called, all ports are freed and set to
null.
When unbinding the device after failure, ata_host_stop() is called
to release the resources, it leads a null-ptr-deref(), because all
the ports all freed and null.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
CPU: 7 PID: 18671 Comm: modprobe Kdump: loaded Tainted: G E 6.1.0-rc3+ #8
pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=
Red Hat
kernel: ata: libata-transport: fix double ata_host_put() in ata_tport_add()
vendor_redhat·2025-05-01·CVSS 7.8
CVE-2022-49826 [HIGH] CWE-416 kernel: ata: libata-transport: fix double ata_host_put() in ata_tport_add()
kernel: ata: libata-transport: fix double ata_host_put() in ata_tport_add()
In the Linux kernel, the following vulnerability has been resolved:
ata: libata-transport: fix double ata_host_put() in ata_tport_add()
In the error path in ata_tport_add(), when calling put_device(),
ata_tport_release() is called, it will put the refcount of 'ap->host'.
And then ata_host_put() is called again, the refcount is decreased
to 0, ata_host_release() is called, all ports are freed and set to
null.
When unbinding the device after failure, ata_host_stop() is called
to release the resources, it leads a null-ptr-deref(), because all
the ports all freed and null.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
CPU: 7 PID: 18671 Comm: modprobe Kdump: loaded Tainted: G E 6.
Debian
CVE-2022-49826: linux - In the Linux kernel, the following vulnerability has been resolved: ata: libata...
vendor_debian·2022·CVSS 7.8
CVE-2022-49826 [HIGH] CVE-2022-49826: linux - In the Linux kernel, the following vulnerability has been resolved: ata: libata...
In the Linux kernel, the following vulnerability has been resolved: ata: libata-transport: fix double ata_host_put() in ata_tport_add() In the error path in ata_tport_add(), when calling put_device(), ata_tport_release() is called, it will put the refcount of 'ap->host'. And then ata_host_put() is called again, the refcount is decreased to 0, ata_host_release() is called, all ports are freed and set to null. When unbinding the device after failure, ata_host_stop() is called to release the resources, it leads a null-ptr-deref(), because all the ports all freed and null. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 CPU: 7 PID: 18671 Comm: modprobe Kdump: loaded Tainted: G E 6.1.0-rc3+ #8 pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) p
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/30e12e2be27ac6c4be2af4163c70db381364706fhttps://git.kernel.org/stable/c/377ff82c33c0cb74562a353361b64b33c09562cfhttps://git.kernel.org/stable/c/865a6da40ba092c18292ae5f6194756131293745https://git.kernel.org/stable/c/8c76310740807ade5ecdab5888f70ecb6d35732ehttps://git.kernel.org/stable/c/ac471468f7c16cda2525909946ca13ddbcd14000https://git.kernel.org/stable/c/bec9ded5404cb14e5f5470103d0973a2ff83d6a5
2025-05-01
Published