# CVE-2022-48692: linux: In the Linux kernel, the following vulnerability has been resolved:  RDMA/srp: Set scmnd->result only when scmnd is n...

CVE-2022-48692 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-48692, released May 3, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2022-48692
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0061
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: May 3, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  RDMA/srp: Set scmnd->result only when scmnd is not NULL  This change fixes the following kernel NULL pointer dereference which is reproduced by blktests srp/007 occasionally.  BUG: kernel NULL pointer dereference, address: 0000000000000170 PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 9 Comm: kworker/0:1H Kdump: loaded Not tainted 6.0.0-rc1+ #37 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.15.0-29-g6a62e0cb0dfe-prebuilt.qemu.org 04/01/2014 Workqueue:  0x0 (kblockd) RIP: 0010:srp_recv_done+0x176/0x500 [ib_srp] Code: 00 4d 85 ff 0f 84 52 02 00 00 48 c7 82 80 02 00 00 00 00 00 00 4c 89 df 4c 89 14 24 e8 53 d3 4a f6 4c 8b 14 24 41 0f b6 42 13 <41> 89 87 70 01 00 00 41 0f b6 52 12 f6 c2 02 74 44 41 8b 42 1c b9 RSP: 0018:ffffaef7c0003e28 EFLAGS: 00000282 RAX: 0000000000000000 RBX: ffff9bc9486dea60 RCX: 0000000000000000 RDX: 0000000000000102 RSI: ffffffffb76bbd0e RDI: 00000000ffffffff RBP: ffff9bc980099a00 R08: 0000000000000001 R09: 0000000000000001 R10: ffff9bca53ef0000 R11: ffff9bc980099a10 R12: ffff9bc956e14000 R13: ffff9bc9836b9cb0 R14: ffff9bc9557b4480 R15: 0000000000000000 FS:  0000000000000000(0000) GS:ffff9bc97ec00000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000170 CR3: 0000000007e04000 CR4: 00000000000006f0 Call Trace:  <IRQ>  __ib_process_cq+0xb7/0x280 [ib_core]  ib_poll_handler+0x2b/0x130 [ib_core]  irq_poll_softirq+0x93/0x150  __do_softirq+0xee/0x4b8  irq_exit_rcu+0xf7/0x130  sysvec_apic_timer_interrupt+0x8e/0xc0  </IRQ>

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 5.19.11-1 | [DEBIAN-CVE-2022-48692](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48692.md) | May 3, 2024 |
| Linux | linux Debian 13.5 (trixie) | 5.19.11-1 | [DEBIAN-CVE-2022-48692](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48692.md) | May 3, 2024 |
| Linux | linux Debian 14 | 5.19.11-1 | [DEBIAN-CVE-2022-48692](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48692.md) | May 3, 2024 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.