{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2022-49308", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-02-26T02:08:31.536Z", "datePublished": "2025-02-26T02:10:39.648Z", "dateUpdated": "2026-05-11T18:57:10.523Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T18:57:10.523Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nextcon: Modify extcon device to be created after driver data is set\n\nCurrently, someone can invoke the sysfs such as state_show()\nintermittently before dev_set_drvdata() is done.\nAnd it can be a cause of kernel Oops because of edev is Null at that time.\nSo modified the driver registration to after setting drviver data.\n\n- Oops's backtrace.\n\nBacktrace:\n[<c067865c>] (state_show) from [<c05222e8>] (dev_attr_show)\n[<c05222c0>] (dev_attr_show) from [<c02c66e0>] (sysfs_kf_seq_show)\n[<c02c6648>] (sysfs_kf_seq_show) from [<c02c496c>] (kernfs_seq_show)\n[<c02c4938>] (kernfs_seq_show) from [<c025e2a0>] (seq_read)\n[<c025e11c>] (seq_read) from [<c02c50a0>] (kernfs_fop_read)\n[<c02c5064>] (kernfs_fop_read) from [<c0231cac>] (__vfs_read)\n[<c0231c5c>] (__vfs_read) from [<c0231ee0>] (vfs_read)\n[<c0231e34>] (vfs_read) from [<c0232464>] (ksys_read)\n[<c02323f0>] (ksys_read) from [<c02324fc>] (sys_read)\n[<c02324e4>] (sys_read) from [<c00091d0>] (__sys_trace_return)"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/extcon/extcon.c"], "versions": [{"version": "de55d8716ac50a356cea736c29bb7db5ac3d0190", "lessThan": "6e721f3ad0535b24f19a62420f4da95212cf069c", "status": "affected", "versionType": "git"}, {"version": "de55d8716ac50a356cea736c29bb7db5ac3d0190", "lessThan": "cb81ea998c461868d1168411a867d8ffee12f23f", "status": "affected", "versionType": "git"}, {"version": "de55d8716ac50a356cea736c29bb7db5ac3d0190", "lessThan": "d472c78cc82999d07bd09193a6718016ce9cd386", "status": "affected", "versionType": "git"}, {"version": "de55d8716ac50a356cea736c29bb7db5ac3d0190", "lessThan": "abf3b222614f49f98e606fccdd269161c0d70204", "status": "affected", "versionType": "git"}, {"version": "de55d8716ac50a356cea736c29bb7db5ac3d0190", "lessThan": "368e68ad6da4317fc4170e8d92b51c13d1bfe7a7", "status": "affected", "versionType": "git"}, {"version": "de55d8716ac50a356cea736c29bb7db5ac3d0190", "lessThan": "35ff1ac55d301efb3f467cf5426faaeb3452994b", "status": "affected", "versionType": "git"}, {"version": "de55d8716ac50a356cea736c29bb7db5ac3d0190", "lessThan": "033ec4e7e59ae5e1ef1e8c10bc6552926044ed1c", "status": "affected", "versionType": "git"}, {"version": "de55d8716ac50a356cea736c29bb7db5ac3d0190", "lessThan": "5dcc2afe716d69f5112ce035cb14f007461ff189", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/extcon/extcon.c"], "versions": [{"version": "3.5", "status": "affected"}, {"version": "0", "lessThan": "3.5", "status": "unaffected", "versionType": "semver"}, {"version": "4.14.283", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.247", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.198", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.122", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.47", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.17.15", "lessThanOrEqual": "5.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.18.4", "lessThanOrEqual": "5.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "4.14.283"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "4.19.247"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "5.4.198"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "5.10.122"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "5.15.47"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "5.17.15"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "5.18.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "5.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6e721f3ad0535b24f19a62420f4da95212cf069c"}, {"url": "https://git.kernel.org/stable/c/cb81ea998c461868d1168411a867d8ffee12f23f"}, {"url": "https://git.kernel.org/stable/c/d472c78cc82999d07bd09193a6718016ce9cd386"}, {"url": "https://git.kernel.org/stable/c/abf3b222614f49f98e606fccdd269161c0d70204"}, {"url": "https://git.kernel.org/stable/c/368e68ad6da4317fc4170e8d92b51c13d1bfe7a7"}, {"url": "https://git.kernel.org/stable/c/35ff1ac55d301efb3f467cf5426faaeb3452994b"}, {"url": "https://git.kernel.org/stable/c/033ec4e7e59ae5e1ef1e8c10bc6552926044ed1c"}, {"url": "https://git.kernel.org/stable/c/5dcc2afe716d69f5112ce035cb14f007461ff189"}], "title": "extcon: Modify extcon device to be created after driver data is set", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "42074657-A7B6-4740-88B7-67B440018C1C", "versionEndExcluding": "4.14.283", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B8CFA0F4-2D75-41F4-9753-87944A08B53B", "versionEndExcluding": "4.19.247", "versionStartIncluding": "4.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3EC49633-14DE-4EBD-BB80-76AE2E3EABB9", "versionEndExcluding": "5.4.198", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1B42AA01-44D8-4572-95E6-FF8E374CF9C5", "versionEndExcluding": "5.10.122", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FC042EE3-4864-4325-BE0B-4BCDBF11AA61", "versionEndExcluding": "5.15.47", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "53E7AA2E-2FB4-45CA-A22B-08B4EDBB51AD", "versionEndExcluding": "5.17.15", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FA6D643C-6D6A-4821-8A8D-B5776B8F0103", "versionEndExcluding": "5.18.4", "versionStartIncluding": "5.18", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nextcon: Modify extcon device to be created after driver data is set\n\nCurrently, someone can invoke the sysfs such as state_show()\nintermittently before dev_set_drvdata() is done.\nAnd it can be a cause of kernel Oops because of edev is Null at that time.\nSo modified the driver registration to after setting drviver data.\n\n- Oops's backtrace.\n\nBacktrace:\n[<c067865c>] (state_show) from [<c05222e8>] (dev_attr_show)\n[<c05222c0>] (dev_attr_show) from [<c02c66e0>] (sysfs_kf_seq_show)\n[<c02c6648>] (sysfs_kf_seq_show) from [<c02c496c>] (kernfs_seq_show)\n[<c02c4938>] (kernfs_seq_show) from [<c025e2a0>] (seq_read)\n[<c025e11c>] (seq_read) from [<c02c50a0>] (kernfs_fop_read)\n[<c02c5064>] (kernfs_fop_read) from [<c0231cac>] (__vfs_read)\n[<c0231c5c>] (__vfs_read) from [<c0231ee0>] (vfs_read)\n[<c0231e34>] (vfs_read) from [<c0232464>] (ksys_read)\n[<c02323f0>] (ksys_read) from [<c02324fc>] (sys_read)\n[<c02324e4>] (sys_read) from [<c00091d0>] (__sys_trace_return)"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: extcon: Modificar el dispositivo extcon para que se cree despu\u00e9s de que se configuren los datos del controlador. Actualmente, alguien puede invocar el sysfs como state_show() de forma intermitente antes de que se realice dev_set_drvdata(). Y puede ser una causa de errores del kernel debido a que edev es Null en ese momento. Por lo tanto, se modific\u00f3 el registro del controlador despu\u00e9s de configurar los datos del controlador. - Ups, el backtrace. Rastreo inverso: [] (mostrar estado) desde [] (mostrar atributo de desarrollo) [] (mostrar atributo de desarrollo) desde [] (mostrar secuencia de sysfs_kf_seq) [] (mostrar secuencia de sysfs_kf_seq) desde [] (mostrar secuencia de kernfs) [] (mostrar secuencia de kernfs) desde [] (leer secuencia) [] (leer secuencia) desde [] (leer secuencia de kernfs_fop) [] (kernfs_fop_read) desde [] (__vfs_read) [] (__vfs_read) desde [] (vfs_read) [] (vfs_read) desde [] (ksys_read) [] (ksys_read) desde [] (sys_read) [] (sys_read) desde [] (__sys_trace_return)"}], "id": "CVE-2022-49308", "lastModified": "2025-10-21T12:19:21.033", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-02-26T07:01:07.607", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/033ec4e7e59ae5e1ef1e8c10bc6552926044ed1c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/35ff1ac55d301efb3f467cf5426faaeb3452994b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/368e68ad6da4317fc4170e8d92b51c13d1bfe7a7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5dcc2afe716d69f5112ce035cb14f007461ff189"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6e721f3ad0535b24f19a62420f4da95212cf069c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/abf3b222614f49f98e606fccdd269161c0d70204"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cb81ea998c461868d1168411a867d8ffee12f23f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d472c78cc82999d07bd09193a6718016ce9cd386"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: extcon: Modify extcon device to be created after driver data is set", "id": "2348348", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2348348"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nextcon: Modify extcon device to be created after driver data is set\nCurrently, someone can invoke the sysfs such as state_show()\nintermittently before dev_set_drvdata() is done.\nAnd it can be a cause of kernel Oops because of edev is Null at that time.\nSo modified the driver registration to after setting drviver data.\n- Oops's backtrace.\nBacktrace:\n[<c067865c>] (state_show) from [<c05222e8>] (dev_attr_show)\n[<c05222c0>] (dev_attr_show) from [<c02c66e0>] (sysfs_kf_seq_show)\n[<c02c6648>] (sysfs_kf_seq_show) from [<c02c496c>] (kernfs_seq_show)\n[<c02c4938>] (kernfs_seq_show) from [<c025e2a0>] (seq_read)\n[<c025e11c>] (seq_read) from [<c02c50a0>] (kernfs_fop_read)\n[<c02c5064>] (kernfs_fop_read) from [<c0231cac>] (__vfs_read)\n[<c0231c5c>] (__vfs_read) from [<c0231ee0>] (vfs_read)\n[<c0231e34>] (vfs_read) from [<c0232464>] (ksys_read)\n[<c02323f0>] (ksys_read) from [<c02324fc>] (sys_read)\n[<c02324e4>] (sys_read) from [<c00091d0>] (__sys_trace_return)"], "name": "CVE-2022-49308", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-02-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-49308\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-49308\nhttps://lore.kernel.org/linux-cve-announce/2025022635-CVE-2022-49308-23f0@gregkh/T"], "threat_severity": "Low"}

{"created": "2025-07-12T22:31:14.247190+00:00", "updated": "2025-07-12T22:31:14.247259+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}