{
  "cveId": "CVE-2022-49509",
  "url": "https://patchblox.com/security/cve/CVE-2022-49509",
  "summary": "CVE-2022-49509 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49509, released February 26, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  media: i2c: max9286: fix kernel oops when removi...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  media: i2c: max9286: fix kernel oops when removing module  When removing the max9286 module we get a kernel oops:  Unable to handle kernel paging request at virtual address 000000aa00000094 Mem abort info:   ESR = 0x96000004   EC = 0x25: DABT (current EL), IL = 32 bits   SET = 0, FnV = 0   EA = 0, S1PTW = 0   FSC = 0x04: level 0 translation fault Data abort info:   ISV = 0, ISS = 0x00000004   CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000880d85000 [000000aa00000094] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 96000004 [#1] PREEMPT SMP Modules linked in: fsl_jr_uio caam_jr rng_core libdes caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine max9271 authenc crct10dif_ce mxc_jpeg_encdec CPU: 2 PID: 713 Comm: rmmod Tainted: G         C        5.15.5-00057-gaebcd29c8ed7-dirty #5 Hardware name: Freescale i.MX8QXP MEK (DT) pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : i2c_mux_del_adapters\u002B0x24/0xf0 lr : max9286_remove\u002B0x28/0xd0 [max9286] sp : ffff800013a9bbf0 x29: ffff800013a9bbf0 x28: ffff00080b6da940 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 x23: ffff000801a5b970 x22: ffff0008048b0890 x21: ffff800009297000 x20: ffff0008048b0f70 x19: 000000aa00000064 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000014 x13: 0000000000000000 x12: ffff000802da49e8 x11: ffff000802051918 x10: ffff000802da4920 x9 : ffff000800030098 x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff6364626d x5 : 8080808000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffffffffffffffff x1 : ffff00080b6da940 x0 : 0000000000000000 Call trace:  i2c_mux_del_adapters\u002B0x24/0xf0  max9286_remove\u002B0x28/0xd0 [max9286]  i2c_device_remove\u002B0x40/0x110  __device_release_driver\u002B0x188/0x234  driver_detach\u002B0xc4/0x150  bus_remove_driver\u002B0x60/0xe0  driver_unregister\u002B0x34/0x64  i2c_del_driver\u002B0x58/0xa0  max9286_i2c_driver_exit\u002B0x1c/0x490 [max9286]  __arm64_sys_delete_module\u002B0x194/0x260  invoke_syscall\u002B0x48/0x114  el0_svc_common.constprop.0\u002B0xd4/0xfc  do_el0_svc\u002B0x2c/0x94  el0_svc\u002B0x28/0x80  el0t_64_sync_handler\u002B0xa8/0x130  el0t_64_sync\u002B0x1a0/0x1a4  The Oops happens because the I2C client data does not point to max9286_priv anymore but to v4l2_subdev. The change happened in max9286_init() which calls v4l2_i2c_subdev_init() later on...  Besides fixing the max9286_remove() function, remove the call to i2c_set_clientdata() in max9286_probe(), to avoid confusion, and make the necessary changes to max9286_init() so that it doesn\u0027t have to use i2c_get_clientdata() in order to fetch the pointer to priv.",
  "published": "2025-02-26T07:01:27Z",
  "severity": "high",
  "cvss": 7.1,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
  "epss": 0.00293,
  "epssPercentile": 0.22089,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.18.5-1",
      "fix": "DEBIAN-CVE-2022-49509",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49509",
      "released": "2025-02-26T07:01:27Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.18.5-1",
      "fix": "DEBIAN-CVE-2022-49509",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49509",
      "released": "2025-02-26T07:01:27Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.18.5-1",
      "fix": "DEBIAN-CVE-2022-49509",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49509",
      "released": "2025-02-26T07:01:27Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}