GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49070 (GCVE-0-2022-49070)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:54 – Updated: 2026-05-11 18:52
VLAI
Title
fbdev: Fix unregistering of framebuffers without device
Summary
In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix unregistering of framebuffers without device OF framebuffers do not have an underlying device in the Linux device hierarchy. Do a regular unregister call instead of hot unplugging such a non-existing device. Fixes a NULL dereference. An example error message on ppc64le is shown below. BUG: Kernel NULL pointer dereference on read at 0x00000060 Faulting instruction address: 0xc00000000080dfa4 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries [...] CPU: 2 PID: 139 Comm: systemd-udevd Not tainted 5.17.0-ae085d7f9365 #1 NIP: c00000000080dfa4 LR: c00000000080df9c CTR: c000000000797430 REGS: c000000004132fe0 TRAP: 0300 Not tainted (5.17.0-ae085d7f9365) MSR: 8000000002009033 <SF,VEC,EE,ME,IR,DR,RI,LE> CR: 28228282 XER: 20000000 CFAR: c00000000000c80c DAR: 0000000000000060 DSISR: 40000000 IRQMASK: 0 GPR00: c00000000080df9c c000000004133280 c00000000169d200 0000000000000029 GPR04: 00000000ffffefff c000000004132f90 c000000004132f88 0000000000000000 GPR08: c0000000015658f8 c0000000015cd200 c0000000014f57d0 0000000048228283 GPR12: 0000000000000000 c00000003fffe300 0000000020000000 0000000000000000 GPR16: 0000000000000000 0000000113fc4a40 0000000000000005 0000000113fcfb80 GPR20: 000001000f7283b0 0000000000000000 c000000000e4a588 c000000000e4a5b0 GPR24: 0000000000000001 00000000000a0000 c008000000db0168 c0000000021f6ec0 GPR28: c0000000016d65a8 c000000004b36460 0000000000000000 c0000000016d64b0 NIP [c00000000080dfa4] do_remove_conflicting_framebuffers+0x184/0x1d0 [c000000004133280] [c00000000080df9c] do_remove_conflicting_framebuffers+0x17c/0x1d0 (unreliable) [c000000004133350] [c00000000080e4d0] remove_conflicting_framebuffers+0x60/0x150 [c0000000041333a0] [c00000000080e6f4] remove_conflicting_pci_framebuffers+0x134/0x1b0 [c000000004133450] [c008000000e70438] drm_aperture_remove_conflicting_pci_framebuffers+0x90/0x100 [drm] [c000000004133490] [c008000000da0ce4] bochs_pci_probe+0x6c/0xa64 [bochs] [...] [c000000004133db0] [c00000000002aaa0] system_call_exception+0x170/0x2d0 [c000000004133e10] [c00000000000c3cc] system_call_common+0xec/0x250 The bug [1] was introduced by commit 27599aacbaef ("fbdev: Hot-unplug firmware fb devices on forced removal"). Most firmware framebuffers have an underlying platform device, which can be hot-unplugged before loading the native graphics driver. OF framebuffers do not (yet) have that device. Fix the code by unregistering the framebuffer as before without a hot unplug. Tested with 5.17 on qemu ppc64le emulation.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 19:49 UTC
CWE
  • CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c894ac44786cfed383a6c6b20c1bfb12eb96018a , < 2388f826cdc9af2651991adc0feb79de9bdf2232 (git)
Affected: 9565a3b5203a4d57acbc1d0e981c6df71864b4ab , < de33df481545974ba47c46f05194e769e4307843 (git)
Affected: 4d695d7c276f15adb1d2b64c584c3cf8f4f9e9ce , < feed87ff122b1640c221d4dd559442ab2cd50bb1 (git)
Affected: 27599aacbaefcbf2af7b06b0029459bbf682000d , < 0f525289ff0ddeb380813bd81e0f9bdaaa1c9078 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15.33 , < 5.15.34 (semver)
Affected: 5.16.19 , < 5.16.20 (semver)
Affected: 5.17.2 , < 5.17.3 (semver)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49070",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:49:37.472130Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:57:06.034Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/core/fbmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2388f826cdc9af2651991adc0feb79de9bdf2232",
              "status": "affected",
              "version": "c894ac44786cfed383a6c6b20c1bfb12eb96018a",
              "versionType": "git"
            },
            {
              "lessThan": "de33df481545974ba47c46f05194e769e4307843",
              "status": "affected",
              "version": "9565a3b5203a4d57acbc1d0e981c6df71864b4ab",
              "versionType": "git"
            },
            {
              "lessThan": "feed87ff122b1640c221d4dd559442ab2cd50bb1",
              "status": "affected",
              "version": "4d695d7c276f15adb1d2b64c584c3cf8f4f9e9ce",
              "versionType": "git"
            },
            {
              "lessThan": "0f525289ff0ddeb380813bd81e0f9bdaaa1c9078",
              "status": "affected",
              "version": "27599aacbaefcbf2af7b06b0029459bbf682000d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/core/fbmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5.15.34",
              "status": "affected",
              "version": "5.15.33",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16.20",
              "status": "affected",
              "version": "5.16.19",
              "versionType": "semver"
            },
            {
              "lessThan": "5.17.3",
              "status": "affected",
              "version": "5.17.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.34",
                  "versionStartIncluding": "5.15.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.20",
                  "versionStartIncluding": "5.16.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.3",
                  "versionStartIncluding": "5.17.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: Fix unregistering of framebuffers without device\n\nOF framebuffers do not have an underlying device in the Linux\ndevice hierarchy. Do a regular unregister call instead of hot\nunplugging such a non-existing device. Fixes a NULL dereference.\nAn example error message on ppc64le is shown below.\n\n  BUG: Kernel NULL pointer dereference on read at 0x00000060\n  Faulting instruction address: 0xc00000000080dfa4\n  Oops: Kernel access of bad area, sig: 11 [#1]\n  LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries\n  [...]\n  CPU: 2 PID: 139 Comm: systemd-udevd Not tainted 5.17.0-ae085d7f9365 #1\n  NIP:  c00000000080dfa4 LR: c00000000080df9c CTR: c000000000797430\n  REGS: c000000004132fe0 TRAP: 0300   Not tainted  (5.17.0-ae085d7f9365)\n  MSR:  8000000002009033 \u003cSF,VEC,EE,ME,IR,DR,RI,LE\u003e  CR: 28228282  XER: 20000000\n  CFAR: c00000000000c80c DAR: 0000000000000060 DSISR: 40000000 IRQMASK: 0\n  GPR00: c00000000080df9c c000000004133280 c00000000169d200 0000000000000029\n  GPR04: 00000000ffffefff c000000004132f90 c000000004132f88 0000000000000000\n  GPR08: c0000000015658f8 c0000000015cd200 c0000000014f57d0 0000000048228283\n  GPR12: 0000000000000000 c00000003fffe300 0000000020000000 0000000000000000\n  GPR16: 0000000000000000 0000000113fc4a40 0000000000000005 0000000113fcfb80\n  GPR20: 000001000f7283b0 0000000000000000 c000000000e4a588 c000000000e4a5b0\n  GPR24: 0000000000000001 00000000000a0000 c008000000db0168 c0000000021f6ec0\n  GPR28: c0000000016d65a8 c000000004b36460 0000000000000000 c0000000016d64b0\n  NIP [c00000000080dfa4] do_remove_conflicting_framebuffers+0x184/0x1d0\n  [c000000004133280] [c00000000080df9c] do_remove_conflicting_framebuffers+0x17c/0x1d0 (unreliable)\n  [c000000004133350] [c00000000080e4d0] remove_conflicting_framebuffers+0x60/0x150\n  [c0000000041333a0] [c00000000080e6f4] remove_conflicting_pci_framebuffers+0x134/0x1b0\n  [c000000004133450] [c008000000e70438] drm_aperture_remove_conflicting_pci_framebuffers+0x90/0x100 [drm]\n  [c000000004133490] [c008000000da0ce4] bochs_pci_probe+0x6c/0xa64 [bochs]\n  [...]\n  [c000000004133db0] [c00000000002aaa0] system_call_exception+0x170/0x2d0\n  [c000000004133e10] [c00000000000c3cc] system_call_common+0xec/0x250\n\nThe bug [1] was introduced by commit 27599aacbaef (\"fbdev: Hot-unplug\nfirmware fb devices on forced removal\"). Most firmware framebuffers\nhave an underlying platform device, which can be hot-unplugged\nbefore loading the native graphics driver. OF framebuffers do not\n(yet) have that device. Fix the code by unregistering the framebuffer\nas before without a hot unplug.\n\nTested with 5.17 on qemu ppc64le emulation."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:52:26.824Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2388f826cdc9af2651991adc0feb79de9bdf2232"
        },
        {
          "url": "https://git.kernel.org/stable/c/de33df481545974ba47c46f05194e769e4307843"
        },
        {
          "url": "https://git.kernel.org/stable/c/feed87ff122b1640c221d4dd559442ab2cd50bb1"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f525289ff0ddeb380813bd81e0f9bdaaa1c9078"
        }
      ],
      "title": "fbdev: Fix unregistering of framebuffers without device",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49070",
    "datePublished": "2025-02-26T01:54:36.360Z",
    "dateReserved": "2025-02-26T01:49:39.244Z",
    "dateUpdated": "2026-05-11T18:52:26.824Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49070",
      "date": "2026-09-14",
      "epss": "0.00256",
      "percentile": "0.1732"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49070\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:00:44.217\",\"lastModified\":\"2026-06-17T05:16:59.840\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfbdev: Fix unregistering of framebuffers without device\\n\\nOF framebuffers do not have an underlying device in the Linux\\ndevice hierarchy. Do a regular unregister call instead of hot\\nunplugging such a non-existing device. Fixes a NULL dereference.\\nAn example error message on ppc64le is shown below.\\n\\n  BUG: Kernel NULL pointer dereference on read at 0x00000060\\n  Faulting instruction address: 0xc00000000080dfa4\\n  Oops: Kernel access of bad area, sig: 11 [#1]\\n  LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries\\n  [...]\\n  CPU: 2 PID: 139 Comm: systemd-udevd Not tainted 5.17.0-ae085d7f9365 #1\\n  NIP:  c00000000080dfa4 LR: c00000000080df9c CTR: c000000000797430\\n  REGS: c000000004132fe0 TRAP: 0300   Not tainted  (5.17.0-ae085d7f9365)\\n  MSR:  8000000002009033 \u003cSF,VEC,EE,ME,IR,DR,RI,LE\u003e  CR: 28228282  XER: 20000000\\n  CFAR: c00000000000c80c DAR: 0000000000000060 DSISR: 40000000 IRQMASK: 0\\n  GPR00: c00000000080df9c c000000004133280 c00000000169d200 0000000000000029\\n  GPR04: 00000000ffffefff c000000004132f90 c000000004132f88 0000000000000000\\n  GPR08: c0000000015658f8 c0000000015cd200 c0000000014f57d0 0000000048228283\\n  GPR12: 0000000000000000 c00000003fffe300 0000000020000000 0000000000000000\\n  GPR16: 0000000000000000 0000000113fc4a40 0000000000000005 0000000113fcfb80\\n  GPR20: 000001000f7283b0 0000000000000000 c000000000e4a588 c000000000e4a5b0\\n  GPR24: 0000000000000001 00000000000a0000 c008000000db0168 c0000000021f6ec0\\n  GPR28: c0000000016d65a8 c000000004b36460 0000000000000000 c0000000016d64b0\\n  NIP [c00000000080dfa4] do_remove_conflicting_framebuffers+0x184/0x1d0\\n  [c000000004133280] [c00000000080df9c] do_remove_conflicting_framebuffers+0x17c/0x1d0 (unreliable)\\n  [c000000004133350] [c00000000080e4d0] remove_conflicting_framebuffers+0x60/0x150\\n  [c0000000041333a0] [c00000000080e6f4] remove_conflicting_pci_framebuffers+0x134/0x1b0\\n  [c000000004133450] [c008000000e70438] drm_aperture_remove_conflicting_pci_framebuffers+0x90/0x100 [drm]\\n  [c000000004133490] [c008000000da0ce4] bochs_pci_probe+0x6c/0xa64 [bochs]\\n  [...]\\n  [c000000004133db0] [c00000000002aaa0] system_call_exception+0x170/0x2d0\\n  [c000000004133e10] [c00000000000c3cc] system_call_common+0xec/0x250\\n\\nThe bug [1] was introduced by commit 27599aacbaef (\\\"fbdev: Hot-unplug\\nfirmware fb devices on forced removal\\\"). Most firmware framebuffers\\nhave an underlying platform device, which can be hot-unplugged\\nbefore loading the native graphics driver. OF framebuffers do not\\n(yet) have that device. Fix the code by unregistering the framebuffer\\nas before without a hot unplug.\\n\\nTested with 5.17 on qemu ppc64le emulation.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fbdev: Se corrige la anulaci\u00f3n del registro de los framebuffers sin dispositivo. Los framebuffers OF no tienen un dispositivo subyacente en la jerarqu\u00eda de dispositivos de Linux. Se realiza una llamada de anulaci\u00f3n del registro normal en lugar de desconectar en caliente un dispositivo inexistente. Se corrige una desreferencia NULL. A continuaci\u00f3n se muestra un mensaje de error de ejemplo en ppc64le. ERROR: Desreferencia de puntero NULL del kernel en lectura en 0x00000060 Direcci\u00f3n de instrucci\u00f3n con error: 0xc00000000080dfa4 Oops: Acceso del kernel al \u00e1rea defectuosa, firma: 11 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries [...] CPU: 2 PID: 139 Comm: systemd-udevd No contaminado 5.17.0-ae085d7f9365 #1 NIP: c00000000080dfa4 LR: c00000000080df9c CTR: c000000000797430 REGS: c000000004132fe0 TRAP: 0300 No contaminado (5.17.0-ae085d7f9365) MSR: 8000000002009033  CR: 28228282 XER: 20000000 CFAR: c00000000000c80c DAR: 0000000000000060 DSISR: 40000000 IRQMASK: 0 GPR00: c00000000080df9c c000000004133280 c00000000169d200 0000000000000029 GPR04: 00000000fffffff c000000004132f90 c000000004132f88 00000000000000000 GPR08: c0000000015658f8 c0000000015cd200 c0000000014f57d0 0000000048228283 GPR12: 000000000000000 c0000003fffe300 000000002000000 000000000000000 GPR16: 000000000000000 0000000113fc4a40 000000000000005 0000000113fcfb80 GPR20: 000001000f7283b0 0000000000000000 c000000000e4a588 c000000000e4a5b0 GPR24: 0000000000000001 00000000000a000 c008000000db0168 c0000000021f6ec0 GPR28: c0000000016d65a8 c000000004b36460 000000000000000 c0000000016d64b0 PIP [c00000000080dfa4] do_remove_conflicting_framebuffers+0x184/0x1d0 [c000000004133280] [c00000000080df9c] do_remove_conflicting_framebuffers+0x17c/0x1d0 (no confiable) [c000000004133350] [c00000000080e4d0] remove_conflicting_framebuffers+0x60/0x150 [c0000000041333a0] [c00000000080e6f4] remove_conflicting_pci_framebuffers+0x134/0x1b0 [c000000004133450] [c008000000e70438] drm_aperture_remove_conflicting_pci_framebuffers+0x90/0x100 [drm] [c000000004133490] [c008000000da0ce4] bochs_pci_probe+0x6c/0xa64 [bochs] [...] [c000000004133db0] [c00000000002aaa0] system_call_exception+0x170/0x2d0 [c000000004133e10] [c00000000000c3cc] system_call_common+0xec/0x250 El error [1] fue introducido por el commit 27599aacbaef (\\\"fbdev: Desconexi\u00f3n en caliente dispositivos fb de firmware en caso de eliminaci\u00f3n forzada\\\"). La mayor\u00eda de los framebuffers de firmware tienen un dispositivo de plataforma subyacente, que se puede desconectar en caliente antes de cargar el controlador de gr\u00e1ficos nativo. Los framebuffers de OF no tienen (todav\u00eda) ese dispositivo. Corrija el c\u00f3digo anulando el registro del framebuffer como antes sin una desconexi\u00f3n en caliente. Probado con 5.17 en emulaci\u00f3n qemu ppc64le.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/video/fbdev/core/fbmem.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c894ac44786cfed383a6c6b20c1bfb12eb96018a\",\"lessThan\":\"2388f826cdc9af2651991adc0feb79de9bdf2232\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9565a3b5203a4d57acbc1d0e981c6df71864b4ab\",\"lessThan\":\"de33df481545974ba47c46f05194e769e4307843\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4d695d7c276f15adb1d2b64c584c3cf8f4f9e9ce\",\"lessThan\":\"feed87ff122b1640c221d4dd559442ab2cd50bb1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"27599aacbaefcbf2af7b06b0029459bbf682000d\",\"lessThan\":\"0f525289ff0ddeb380813bd81e0f9bdaaa1c9078\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/video/fbdev/core/fbmem.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15.33\",\"lessThan\":\"5.15.34\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.16.19\",\"lessThan\":\"5.16.20\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.17.2\",\"lessThan\":\"5.17.3\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:49:37.472130Z\",\"id\":\"CVE-2022-49070\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15.33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6131A2B3-2D6E-458C-84F4-DD3DAA7821FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.16.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C2874235-06C6-40EC-97B6-C17C6985DE5D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.17.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB6B77A5-BC82-489A-BB4D-89562A8B34E4\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0f525289ff0ddeb380813bd81e0f9bdaaa1c9078\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2388f826cdc9af2651991adc0feb79de9bdf2232\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/de33df481545974ba47c46f05194e769e4307843\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/feed87ff122b1640c221d4dd559442ab2cd50bb1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-30T10:39:05+00:00",
      "cve": "CVE-2022-49070",
      "id": "CVE-2022-49070",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "201",
      "product_status:known_affected": "70",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: fbdev: Fix unregistering of framebuffers without device",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49070.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T16:55:39Z",
      "cve": "CVE-2022-49070",
      "id": "CVE-2022-49070",
      "initial_release_date": "2025-02-27T03:12:45Z",
      "product_status:known_affected": "364",
      "product_status:known_not_affected": "409",
      "product_status:recommended": "127",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49070",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49070.json",
      "version": "37"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-49070\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:49:37.472130Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T16:04:05.277Z\"}}], \"cna\": {\"title\": \"fbdev: Fix unregistering of framebuffers without device\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c894ac44786cfed383a6c6b20c1bfb12eb96018a\", \"lessThan\": \"2388f826cdc9af2651991adc0feb79de9bdf2232\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9565a3b5203a4d57acbc1d0e981c6df71864b4ab\", \"lessThan\": \"de33df481545974ba47c46f05194e769e4307843\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4d695d7c276f15adb1d2b64c584c3cf8f4f9e9ce\", \"lessThan\": \"feed87ff122b1640c221d4dd559442ab2cd50bb1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"27599aacbaefcbf2af7b06b0029459bbf682000d\", \"lessThan\": \"0f525289ff0ddeb380813bd81e0f9bdaaa1c9078\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/video/fbdev/core/fbmem.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.15.33\", \"lessThan\": \"5.15.34\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.16.19\", \"lessThan\": \"5.16.20\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.17.2\", \"lessThan\": \"5.17.3\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/video/fbdev/core/fbmem.c\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/2388f826cdc9af2651991adc0feb79de9bdf2232\"}, {\"url\": \"https://git.kernel.org/stable/c/de33df481545974ba47c46f05194e769e4307843\"}, {\"url\": \"https://git.kernel.org/stable/c/feed87ff122b1640c221d4dd559442ab2cd50bb1\"}, {\"url\": \"https://git.kernel.org/stable/c/0f525289ff0ddeb380813bd81e0f9bdaaa1c9078\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfbdev: Fix unregistering of framebuffers without device\\n\\nOF framebuffers do not have an underlying device in the Linux\\ndevice hierarchy. Do a regular unregister call instead of hot\\nunplugging such a non-existing device. Fixes a NULL dereference.\\nAn example error message on ppc64le is shown below.\\n\\n  BUG: Kernel NULL pointer dereference on read at 0x00000060\\n  Faulting instruction address: 0xc00000000080dfa4\\n  Oops: Kernel access of bad area, sig: 11 [#1]\\n  LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries\\n  [...]\\n  CPU: 2 PID: 139 Comm: systemd-udevd Not tainted 5.17.0-ae085d7f9365 #1\\n  NIP:  c00000000080dfa4 LR: c00000000080df9c CTR: c000000000797430\\n  REGS: c000000004132fe0 TRAP: 0300   Not tainted  (5.17.0-ae085d7f9365)\\n  MSR:  8000000002009033 \u003cSF,VEC,EE,ME,IR,DR,RI,LE\u003e  CR: 28228282  XER: 20000000\\n  CFAR: c00000000000c80c DAR: 0000000000000060 DSISR: 40000000 IRQMASK: 0\\n  GPR00: c00000000080df9c c000000004133280 c00000000169d200 0000000000000029\\n  GPR04: 00000000ffffefff c000000004132f90 c000000004132f88 0000000000000000\\n  GPR08: c0000000015658f8 c0000000015cd200 c0000000014f57d0 0000000048228283\\n  GPR12: 0000000000000000 c00000003fffe300 0000000020000000 0000000000000000\\n  GPR16: 0000000000000000 0000000113fc4a40 0000000000000005 0000000113fcfb80\\n  GPR20: 000001000f7283b0 0000000000000000 c000000000e4a588 c000000000e4a5b0\\n  GPR24: 0000000000000001 00000000000a0000 c008000000db0168 c0000000021f6ec0\\n  GPR28: c0000000016d65a8 c000000004b36460 0000000000000000 c0000000016d64b0\\n  NIP [c00000000080dfa4] do_remove_conflicting_framebuffers+0x184/0x1d0\\n  [c000000004133280] [c00000000080df9c] do_remove_conflicting_framebuffers+0x17c/0x1d0 (unreliable)\\n  [c000000004133350] [c00000000080e4d0] remove_conflicting_framebuffers+0x60/0x150\\n  [c0000000041333a0] [c00000000080e6f4] remove_conflicting_pci_framebuffers+0x134/0x1b0\\n  [c000000004133450] [c008000000e70438] drm_aperture_remove_conflicting_pci_framebuffers+0x90/0x100 [drm]\\n  [c000000004133490] [c008000000da0ce4] bochs_pci_probe+0x6c/0xa64 [bochs]\\n  [...]\\n  [c000000004133db0] [c00000000002aaa0] system_call_exception+0x170/0x2d0\\n  [c000000004133e10] [c00000000000c3cc] system_call_common+0xec/0x250\\n\\nThe bug [1] was introduced by commit 27599aacbaef (\\\"fbdev: Hot-unplug\\nfirmware fb devices on forced removal\\\"). Most firmware framebuffers\\nhave an underlying platform device, which can be hot-unplugged\\nbefore loading the native graphics driver. OF framebuffers do not\\n(yet) have that device. Fix the code by unregistering the framebuffer\\nas before without a hot unplug.\\n\\nTested with 5.17 on qemu ppc64le emulation.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.34\", \"versionStartIncluding\": \"5.15.33\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.16.20\", \"versionStartIncluding\": \"5.16.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17.3\", \"versionStartIncluding\": \"5.17.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T18:52:26.824Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-49070\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T18:52:26.824Z\", \"dateReserved\": \"2025-02-26T01:49:39.244Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-26T01:54:36.360Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.