cbcvebase.
CVE-2022-49977
published 2025-06-18

CVE-2022-49977: In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead…

PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.22%
12.5th percentile
In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead ftrace_startup does not remove ops from ftrace_ops_list when ftrace_startup_enable fails: register_ftrace_function ftrace_startup __register_ftrace_function ... add_ftrace_ops(&ftrace_ops_list, ops) ... ... ftrace_startup_enable // if ftrace failed to modify, ftrace_disabled is set to 1 ... return 0 // ops is in the ftrace_ops_list. When ftrace_disabled = 1, unregister_ftrace_function simply returns without doing anything: unregister_ftrace_function ftrace_shutdown if (unlikely(ftrace_disabled)) return -ENODEV; // return here, __unregister_ftrace_function is not executed, // as a result, ops is still in the ftrace_ops_list __unregister_ftrace_function ... If ops is dynamically allocated, it will be free later, in this case, is_ftrace_trampoline accesses NULL pointer: is_ftrace_trampoline ftrace_ops_trampoline do_for_each_ftrace_op(op, ftrace_ops_list) // OOPS! op may be NULL! Syzkaller reports as follows: [ 1203.506103] BUG: kernel NULL pointer dereference, address: 000000000000010b [ 1203.508039] #PF: supervisor read access in kernel mode [ 1203.508798] #PF: error_code(0x0000) - not-present page [ 1203.509558] PGD 800000011660b067 P4D 800000011660b067 PUD 130fb8067 PMD 0 [ 1203.510560] Oops: 0000 [#1] SMP KASAN PTI [ 1203.511189] CPU: 6 PID: 29532 Comm: syz-executor.2 Tainted: G B W 5.10.0 #8 [ 1203.512324] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 1203.513895] RIP: 0010:is_ftrace_trampoline+0x26/0xb0 [ 1203.514644] Code: ff eb d3 90 41 55 41 54 49 89 fc 55 53 e8 f2 00 fd ff 48 8b 1d 3b 35 5d 03 e8 e6 00 fd ff 48 8d bb 90 00 00 00 e8 2a 81 26 00 8b ab 90 00 00 00 48 85 ed 74 1d e8 c9 00 fd ff 48 8d bb 98 00 [ 1203.518838] RSP: 0018:ffffc900012cf960 EFLAGS: 00010246 [ 1203.520092] RAX: 0000000000000000 RBX: 000000000000007b RCX: ffffffff8

Affected

30 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.0.2-1 (bookworm)linux 6.0.2-1 (bookworm)
linuxlinux
linuxlinux
linuxlinux
linuxlinux
linuxlinux
linuxlinux>= 3.10.22 < 3.113.11
linuxlinux>= 3.12.3 < 3.133.13
linuxlinux>= 3.2.54 < 3.33.3
linuxlinux>= 3.4.72 < 3.53.5
linuxlinux>= 8a56d7761d2d041ae5e8215d20b4167d8aa93f51 < 8569b4ada1e0b9bfaa125bd0c0967918b6560fa28569b4ada1e0b9bfaa125bd0c0967918b6560fa2
linuxlinux>= 8a56d7761d2d041ae5e8215d20b4167d8aa93f51 < 4c34a2a6c9927c239dd2e295a03d49b37b618d2c4c34a2a6c9927c239dd2e295a03d49b37b618d2c
linuxlinux>= 8a56d7761d2d041ae5e8215d20b4167d8aa93f51 < ddffe882d74ef43a3494f0ab0c24baf076c45f96ddffe882d74ef43a3494f0ab0c24baf076c45f96
linuxlinux>= 8a56d7761d2d041ae5e8215d20b4167d8aa93f51 < 934e49f7d696afdae9f979abe3f308408184e17b934e49f7d696afdae9f979abe3f308408184e17b
linuxlinux>= 8a56d7761d2d041ae5e8215d20b4167d8aa93f51 < dbd8c8fc60480e3faa3ae7e27ebe03371ecd1b77dbd8c8fc60480e3faa3ae7e27ebe03371ecd1b77
linuxlinux>= 8a56d7761d2d041ae5e8215d20b4167d8aa93f51 < e4ae97295984ff1b9b340ed18ae1b066f36b7835e4ae97295984ff1b9b340ed18ae1b066f36b7835
linuxlinux>= 8a56d7761d2d041ae5e8215d20b4167d8aa93f51 < d81bd6671f45fde4c3ac7fd7733c6e3082ae9d8ed81bd6671f45fde4c3ac7fd7733c6e3082ae9d8e
linuxlinux>= 8a56d7761d2d041ae5e8215d20b4167d8aa93f51 < c3b0f72e805f0801f05fa2aa52011c4bfc694c44c3b0f72e805f0801f05fa2aa52011c4bfc694c44
linuxlinux_kernel< 4.9.3274.9.327
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.148-15.10.148-1
linuxlinux_kernel>= 0 < 6.0.2-16.0.2-1
linuxlinux_kernel>= 0 < 6.0.2-16.0.2-1
linuxlinux_kernel>= 0 < 6.0.2-16.0.2-1
linuxlinux_kernel>= 4.10 < 4.14.2924.14.292

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.