CVE-2022-49945
published 2025-06-18CVE-2022-49945: In the Linux kernel, the following vulnerability has been resolved: hwmon: (gpio-fan) Fix array out of bounds access The driver does not check if the cooling…
PriorityP434high7.1CVSS 3.1
AVLACLPRLUINSUCHINAH
EPSS
0.20%
9.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (gpio-fan) Fix array out of bounds access
The driver does not check if the cooling state passed to
gpio_fan_set_cur_state() exceeds the maximum cooling state as
stored in fan_data->num_speeds. Since the cooling state is later
used as an array index in set_fan_speed(), an array out of bounds
access can occur.
This can be exploited by setting the state of the thermal cooling device
to arbitrary values, causing for example a kernel oops when unavailable
memory is accessed this way.
Example kernel oops:
[ 807.987276] Unable to handle kernel paging request at virtual address ffffff80d0588064
[ 807.987369] Mem abort info:
[ 807.987398] ESR = 0x96000005
[ 807.987428] EC = 0x25: DABT (current EL), IL = 32 bits
[ 807.987477] SET = 0, FnV = 0
[ 807.987507] EA = 0, S1PTW = 0
[ 807.987536] FSC = 0x05: level 1 translation fault
[ 807.987570] Data abort info:
[ 807.987763] ISV = 0, ISS = 0x00000005
[ 807.987801] CM = 0, WnR = 0
[ 807.987832] swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000001165000
[ 807.987872] [ffffff80d0588064] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
[ 807.987961] Internal error: Oops: 96000005 [#1] PREEMPT SMP
[ 807.987992] Modules linked in: cmac algif_hash aes_arm64 algif_skcipher af_alg bnep hci_uart btbcm bluetooth ecdh_generic ecc 8021q garp stp llc snd_soc_hdmi_codec brcmfmac vc4 brcmutil cec drm_kms_helper snd_soc_core cfg80211 snd_compress bcm2835_codec(C) snd_pcm_dmaengine syscopyarea bcm2835_isp(C) bcm2835_v4l2(C) sysfillrect v4l2_mem2mem bcm2835_mmal_vchiq(C) raspberrypi_hwmon sysimgblt videobuf2_dma_contig videobuf2_vmalloc fb_sys_fops videobuf2_memops rfkill videobuf2_v4l2 videobuf2_common i2c_bcm2835 snd_bcm2835(C) videodev snd_pcm snd_timer snd mc vc_sm_cma(C) gpio_fan uio_pdrv_genirq uio drm fuse drm_panel_orientation_quirks backlight ip_tables x_tables ipv6
[ 807.988508] CPU: 0 PID: 1321 Comm: bash Tainted: G C 5.15.56-v8+ #1575
[ 807.988
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.2-1 (bookworm) | linux 6.0.2-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= b5cf88e46badea6d600d8515edea23814e03444d < e9f6972ab40a82bd7f6d36800792ba2e084474d8 | e9f6972ab40a82bd7f6d36800792ba2e084474d8 |
| linux | linux | >= b5cf88e46badea6d600d8515edea23814e03444d < 3ff866455e1e263a9ac1958095fd440984248e2f | 3ff866455e1e263a9ac1958095fd440984248e2f |
| linux | linux | >= b5cf88e46badea6d600d8515edea23814e03444d < c8ae6a18708f260ccdeef6ba53af7548457dc26c | c8ae6a18708f260ccdeef6ba53af7548457dc26c |
| linux | linux | >= b5cf88e46badea6d600d8515edea23814e03444d < 7756eb1ed124753f4d64f761fc3d84290dffcb4d | 7756eb1ed124753f4d64f761fc3d84290dffcb4d |
| linux | linux | >= b5cf88e46badea6d600d8515edea23814e03444d < 517dba798793e69b510779c3cde7224a65f3ed1d | 517dba798793e69b510779c3cde7224a65f3ed1d |
| linux | linux | >= b5cf88e46badea6d600d8515edea23814e03444d < 53196e0376205ed49b75bfd0475af5e0fbd20156 | 53196e0376205ed49b75bfd0475af5e0fbd20156 |
| linux | linux | >= b5cf88e46badea6d600d8515edea23814e03444d < 3263984c7acdcb0658155b05a724ed45a10de76d | 3263984c7acdcb0658155b05a724ed45a10de76d |
| linux | linux | >= b5cf88e46badea6d600d8515edea23814e03444d < f233d2be38dbbb22299192292983037f01ab363c | f233d2be38dbbb22299192292983037f01ab363c |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.148-1 | 5.10.148-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 4.1 < 4.9.328 | 4.9.328 |
| linux | linux_kernel | >= 4.10 < 4.14.293 | 4.14.293 |
| linux | linux_kernel | >= 4.15 < 4.19.258 | 4.19.258 |
| linux | linux_kernel | >= 4.20 < 5.4.213 | 5.4.213 |
| linux | linux_kernel | >= 5.11 < 5.15.66 | 5.15.66 |
| linux | linux_kernel | >= 5.16 < 5.19.8 | 5.19.8 |
| linux | linux_kernel | >= 5.5 < 5.10.142 | 5.10.142 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
osv7.1HIGH
vendor_debian7.1HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: hwmon: (gpio-fan) Fix array out of bounds access
vendor_redhat·2025-06-18·CVSS 7.1
CVE-2022-49945 [HIGH] kernel: hwmon: (gpio-fan) Fix array out of bounds access
kernel: hwmon: (gpio-fan) Fix array out of bounds access
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (gpio-fan) Fix array out of bounds access
The driver does not check if the cooling state passed to
gpio_fan_set_cur_state() exceeds the maximum cooling state as
stored in fan_data->num_speeds. Since the cooling state is later
used as an array index in set_fan_speed(), an array out of bounds
access can occur.
This can be exploited by setting the state of the thermal cooling device
to arbitrary values, causing for example a kernel oops when unavailable
memory is accessed this way.
Example kernel oops:
[ 807.987276] Unable to handle kernel paging request at virtual address ffffff80d0588064
[ 807.987369] Mem abort info:
[ 807.987398] ESR = 0x96000005
[ 807.987428
Debian
CVE-2022-49945: linux - In the Linux kernel, the following vulnerability has been resolved: hwmon: (gpi...
vendor_debian·2022·CVSS 7.1
CVE-2022-49945 [HIGH] CVE-2022-49945: linux - In the Linux kernel, the following vulnerability has been resolved: hwmon: (gpi...
In the Linux kernel, the following vulnerability has been resolved: hwmon: (gpio-fan) Fix array out of bounds access The driver does not check if the cooling state passed to gpio_fan_set_cur_state() exceeds the maximum cooling state as stored in fan_data->num_speeds. Since the cooling state is later used as an array index in set_fan_speed(), an array out of bounds access can occur. This can be exploited by setting the state of the thermal cooling device to arbitrary values, causing for example a kernel oops when unavailable memory is accessed this way. Example kernel oops: [ 807.987276] Unable to handle kernel paging request at virtual address ffffff80d0588064 [ 807.987369] Mem abort info: [ 807.987398] ESR = 0x96000005 [ 807.987428] EC = 0x25: DABT (current EL), IL = 32 bits [ 807.987477]
OSV
CVE-2022-49945: In the Linux kernel, the following vulnerability has been resolved: hwmon: (gpio-fan) Fix array out of bounds access The driver does not check if the
osv·2025-06-18·CVSS 7.1
CVE-2022-49945 [HIGH] CVE-2022-49945: In the Linux kernel, the following vulnerability has been resolved: hwmon: (gpio-fan) Fix array out of bounds access The driver does not check if the
In the Linux kernel, the following vulnerability has been resolved: hwmon: (gpio-fan) Fix array out of bounds access The driver does not check if the cooling state passed to gpio_fan_set_cur_state() exceeds the maximum cooling state as stored in fan_data->num_speeds. Since the cooling state is later used as an array index in set_fan_speed(), an array out of bounds access can occur. This can be exploited by setting the state of the thermal cooling device to arbitrary values, causing for example a kernel oops when unavailable memory is accessed this way. Example kernel oops: [ 807.987276] Unable to handle kernel paging request at virtual address ffffff80d0588064 [ 807.987369] Mem abort info: [ 807.987398] ESR = 0x96000005 [ 807.987428] EC = 0x25: DABT (current EL), IL = 32 bits [ 807.987477]
GHSA
GHSA-9555-rxgp-5jjf: In the Linux kernel, the following vulnerability has been resolved:
hwmon: (gpio-fan) Fix array out of bounds access
The driver does not check if th
ghsa_unreviewed·2025-06-18
CVE-2022-49945 [HIGH] CWE-125 GHSA-9555-rxgp-5jjf: In the Linux kernel, the following vulnerability has been resolved:
hwmon: (gpio-fan) Fix array out of bounds access
The driver does not check if th
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (gpio-fan) Fix array out of bounds access
The driver does not check if the cooling state passed to
gpio_fan_set_cur_state() exceeds the maximum cooling state as
stored in fan_data->num_speeds. Since the cooling state is later
used as an array index in set_fan_speed(), an array out of bounds
access can occur.
This can be exploited by setting the state of the thermal cooling device
to arbitrary values, causing for example a kernel oops when unavailable
memory is accessed this way.
Example kernel oops:
[ 807.987276] Unable to handle kernel paging request at virtual address ffffff80d0588064
[ 807.987369] Mem abort info:
[ 807.987398] ESR = 0x96000005
[ 807.987428] EC = 0x25: DABT (current EL), IL = 32 bits
[ 807.9874
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/3263984c7acdcb0658155b05a724ed45a10de76dhttps://git.kernel.org/stable/c/3ff866455e1e263a9ac1958095fd440984248e2fhttps://git.kernel.org/stable/c/517dba798793e69b510779c3cde7224a65f3ed1dhttps://git.kernel.org/stable/c/53196e0376205ed49b75bfd0475af5e0fbd20156https://git.kernel.org/stable/c/7756eb1ed124753f4d64f761fc3d84290dffcb4dhttps://git.kernel.org/stable/c/c8ae6a18708f260ccdeef6ba53af7548457dc26chttps://git.kernel.org/stable/c/e9f6972ab40a82bd7f6d36800792ba2e084474d8https://git.kernel.org/stable/c/f233d2be38dbbb22299192292983037f01ab363c
2025-06-18
Published