cbcvebase.
CVE-2022-49945
published 2025-06-18

CVE-2022-49945: In the Linux kernel, the following vulnerability has been resolved: hwmon: (gpio-fan) Fix array out of bounds access The driver does not check if the cooling…

PriorityP434high7.1CVSS 3.1
AVLACLPRLUINSUCHINAH
EPSS
0.20%
9.6th percentile
In the Linux kernel, the following vulnerability has been resolved: hwmon: (gpio-fan) Fix array out of bounds access The driver does not check if the cooling state passed to gpio_fan_set_cur_state() exceeds the maximum cooling state as stored in fan_data->num_speeds. Since the cooling state is later used as an array index in set_fan_speed(), an array out of bounds access can occur. This can be exploited by setting the state of the thermal cooling device to arbitrary values, causing for example a kernel oops when unavailable memory is accessed this way. Example kernel oops: [ 807.987276] Unable to handle kernel paging request at virtual address ffffff80d0588064 [ 807.987369] Mem abort info: [ 807.987398] ESR = 0x96000005 [ 807.987428] EC = 0x25: DABT (current EL), IL = 32 bits [ 807.987477] SET = 0, FnV = 0 [ 807.987507] EA = 0, S1PTW = 0 [ 807.987536] FSC = 0x05: level 1 translation fault [ 807.987570] Data abort info: [ 807.987763] ISV = 0, ISS = 0x00000005 [ 807.987801] CM = 0, WnR = 0 [ 807.987832] swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000001165000 [ 807.987872] [ffffff80d0588064] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [ 807.987961] Internal error: Oops: 96000005 [#1] PREEMPT SMP [ 807.987992] Modules linked in: cmac algif_hash aes_arm64 algif_skcipher af_alg bnep hci_uart btbcm bluetooth ecdh_generic ecc 8021q garp stp llc snd_soc_hdmi_codec brcmfmac vc4 brcmutil cec drm_kms_helper snd_soc_core cfg80211 snd_compress bcm2835_codec(C) snd_pcm_dmaengine syscopyarea bcm2835_isp(C) bcm2835_v4l2(C) sysfillrect v4l2_mem2mem bcm2835_mmal_vchiq(C) raspberrypi_hwmon sysimgblt videobuf2_dma_contig videobuf2_vmalloc fb_sys_fops videobuf2_memops rfkill videobuf2_v4l2 videobuf2_common i2c_bcm2835 snd_bcm2835(C) videodev snd_pcm snd_timer snd mc vc_sm_cma(C) gpio_fan uio_pdrv_genirq uio drm fuse drm_panel_orientation_quirks backlight ip_tables x_tables ipv6 [ 807.988508] CPU: 0 PID: 1321 Comm: bash Tainted: G C 5.15.56-v8+ #1575 [ 807.988

Affected

22 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.0.2-1 (bookworm)linux 6.0.2-1 (bookworm)
linuxlinux
linuxlinux>= b5cf88e46badea6d600d8515edea23814e03444d < e9f6972ab40a82bd7f6d36800792ba2e084474d8e9f6972ab40a82bd7f6d36800792ba2e084474d8
linuxlinux>= b5cf88e46badea6d600d8515edea23814e03444d < 3ff866455e1e263a9ac1958095fd440984248e2f3ff866455e1e263a9ac1958095fd440984248e2f
linuxlinux>= b5cf88e46badea6d600d8515edea23814e03444d < c8ae6a18708f260ccdeef6ba53af7548457dc26cc8ae6a18708f260ccdeef6ba53af7548457dc26c
linuxlinux>= b5cf88e46badea6d600d8515edea23814e03444d < 7756eb1ed124753f4d64f761fc3d84290dffcb4d7756eb1ed124753f4d64f761fc3d84290dffcb4d
linuxlinux>= b5cf88e46badea6d600d8515edea23814e03444d < 517dba798793e69b510779c3cde7224a65f3ed1d517dba798793e69b510779c3cde7224a65f3ed1d
linuxlinux>= b5cf88e46badea6d600d8515edea23814e03444d < 53196e0376205ed49b75bfd0475af5e0fbd2015653196e0376205ed49b75bfd0475af5e0fbd20156
linuxlinux>= b5cf88e46badea6d600d8515edea23814e03444d < 3263984c7acdcb0658155b05a724ed45a10de76d3263984c7acdcb0658155b05a724ed45a10de76d
linuxlinux>= b5cf88e46badea6d600d8515edea23814e03444d < f233d2be38dbbb22299192292983037f01ab363cf233d2be38dbbb22299192292983037f01ab363c
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.148-15.10.148-1
linuxlinux_kernel>= 0 < 6.0.2-16.0.2-1
linuxlinux_kernel>= 0 < 6.0.2-16.0.2-1
linuxlinux_kernel>= 0 < 6.0.2-16.0.2-1
linuxlinux_kernel>= 4.1 < 4.9.3284.9.328
linuxlinux_kernel>= 4.10 < 4.14.2934.14.293
linuxlinux_kernel>= 4.15 < 4.19.2584.19.258
linuxlinux_kernel>= 4.20 < 5.4.2135.4.213
linuxlinux_kernel>= 5.11 < 5.15.665.15.66
linuxlinux_kernel>= 5.16 < 5.19.85.19.8
linuxlinux_kernel>= 5.5 < 5.10.1425.10.142

CVSS provenance

nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
osv7.1HIGH
vendor_debian7.1HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.