CVE-2022-49875 Details
Description
In the Linux kernel, the following vulnerability has been resolved: bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without FILE When using bpftool to pin {PROG, MAP, LINK} without FILE, segmentation fault will occur. The reson is that the lack of FILE will cause strlen to trigger NULL pointer dereference. The corresponding stacktrace is shown below: do_pin do_pin_any do_pin_fd mount_bpffs_for_pin strlen(name) <- NULL pointer dereference Fix it by adding validation to the common process.
A NULL pointer dereference vulnerability has been identified in the Linux kernel's bpftool utility. This issue arises when bpftool is used to pin programs, maps, or links without specifying a file. The absence of a file reference leads to a segmentation fault, as the tool attempts to determine the length of a NULL string, causing a crash. The vulnerability has been traced back to a lack of proper validation in the pinning process.
The vulnerability has been addressed by adding validation to the pinning process to ensure that a file reference is provided. Users should update to the latest version of the Linux kernel where this fix has been implemented.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 1, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/34de8e6e0e1f66e431abf4123934a2581cb5f133 | kernel.org | Patch |
| https://git.kernel.org/stable/c/6dcdd1b68b7f9333d48d48fc77b75e7f235f6a4a | kernel.org | Patch |
| https://git.kernel.org/stable/c/8c80b2fca4112d724dde477aed13f7b0510a2792 | kernel.org | Patch |
| https://git.kernel.org/stable/c/da5161ba94c5e9182c301dd4f09c94f715c068bd | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
| CWE-476 | NULL Pointer Dereference | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.7, < 5.10.155 >= 5.11, < 5.15.79 >= 5.16, < 6.0.9 6.1 rc1 6.1 rc2 6.1 rc3 6.1 rc4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 1, 2025 | CVE Modified | CISA-ADP |
| May 7, 2025 | Initial Analysis | [email protected] |
| May 1, 2025 | New CVE Received | kernel.org |