{"id":"CVE-2022-49141","state":"PUBLISHED","title":"net: dsa: felix: fix possible NULL pointer dereference","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: felix: fix possible NULL pointer dereference\n\nAs the possible failure of the allocation, kzalloc() may return NULL\npointer.\nTherefore, it should be better to check the 'sgi' in order to prevent\nthe dereference of NULL pointer.","publishedAt":"2025-02-26T01:55:12.197Z","updatedAt":"2026-05-11T18:53:55.975Z","severity":{"score":5.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"CISA-ADP"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"23ae3a7877718931474684ef4fbbaf1d1511ee84","status":"affected","lessThan":"b7ff8b5e75d4e91ec8c62d621aac8dfb84c57aa9","versionType":"git"},{"version":"23ae3a7877718931474684ef4fbbaf1d1511ee84","status":"affected","lessThan":"866b7a278cdb51eb158cd8513bc7438fc857804a","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/dsa/ocelot/felix_vsc9959.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.17","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.17","versionType":"semver"},{"version":"5.17.3","status":"unaffected","lessThanOrEqual":"5.17.*","versionType":"semver"},{"version":"5.18","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/dsa/ocelot/felix_vsc9959.c"]}],"references":["https://git.kernel.org/stable/c/b7ff8b5e75d4e91ec8c62d621aac8dfb84c57aa9","https://git.kernel.org/stable/c/866b7a278cdb51eb158cd8513bc7438fc857804a"],"weaknesses":["CWE-476"],"ingestedAt":"2026-10-29T20:05:26.763Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/49xxx/CVE-2022-49141.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-49141","state":"PUBLISHED","datePublished":"2025-02-26T01:55:12.197Z","dateUpdated":"2026-05-11T18:53:55.975Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-02-26T01:49:39.269Z"},"containers":{"cna":{"title":"net: dsa: felix: fix possible NULL pointer dereference","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: felix: fix possible NULL pointer dereference\n\nAs the possible failure of the allocation, kzalloc() may return NULL\npointer.\nTherefore, it should be better to check the 'sgi' in order to prevent\nthe dereference of NULL pointer."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"23ae3a7877718931474684ef4fbbaf1d1511ee84","status":"affected","lessThan":"b7ff8b5e75d4e91ec8c62d621aac8dfb84c57aa9","versionType":"git"},{"version":"23ae3a7877718931474684ef4fbbaf1d1511ee84","status":"affected","lessThan":"866b7a278cdb51eb158cd8513bc7438fc857804a","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/dsa/ocelot/felix_vsc9959.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.17","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.17","versionType":"semver"},{"version":"5.17.3","status":"unaffected","lessThanOrEqual":"5.17.*","versionType":"semver"},{"version":"5.18","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/dsa/ocelot/felix_vsc9959.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/b7ff8b5e75d4e91ec8c62d621aac8dfb84c57aa9"},{"url":"https://git.kernel.org/stable/c/866b7a278cdb51eb158cd8513bc7438fc857804a"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T18:53:55.975Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.17","versionEndExcluding":"5.17.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.17","versionEndExcluding":"5.18"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2022-49141","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-10-01T19:47:57.520250Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-476","lang":"en","type":"CWE","description":"CWE-476 NULL Pointer Dereference"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-01T19:57:01.859Z"}}]}}}