{
  "cveId": "CVE-2022-49826",
  "url": "https://patchblox.com/security/cve/CVE-2022-49826",
  "summary": "CVE-2022-49826 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49826, released May 1, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  ata: libata-transport: fix double ata_host_put()...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  ata: libata-transport: fix double ata_host_put() in ata_tport_add()  In the error path in ata_tport_add(), when calling put_device(), ata_tport_release() is called, it will put the refcount of \u0027ap-\u003Ehost\u0027.  And then ata_host_put() is called again, the refcount is decreased to 0, ata_host_release() is called, all ports are freed and set to null.  When unbinding the device after failure, ata_host_stop() is called to release the resources, it leads a null-ptr-deref(), because all the ports all freed and null.  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 CPU: 7 PID: 18671 Comm: modprobe Kdump: loaded Tainted: G            E      6.1.0-rc3\u002B #8 pstate: 80400009 (Nzcv daif \u002BPAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : ata_host_stop\u002B0x3c/0x84 [libata] lr : release_nodes\u002B0x64/0xd0 Call trace:  ata_host_stop\u002B0x3c/0x84 [libata]  release_nodes\u002B0x64/0xd0  devres_release_all\u002B0xbc/0x1b0  device_unbind_cleanup\u002B0x20/0x70  really_probe\u002B0x158/0x320  __driver_probe_device\u002B0x84/0x120  driver_probe_device\u002B0x44/0x120  __driver_attach\u002B0xb4/0x220  bus_for_each_dev\u002B0x78/0xdc  driver_attach\u002B0x2c/0x40  bus_add_driver\u002B0x184/0x240  driver_register\u002B0x80/0x13c  __pci_register_driver\u002B0x4c/0x60  ahci_pci_driver_init\u002B0x30/0x1000 [ahci]  Fix this by removing redundant ata_host_put() in the error path.",
  "published": "2025-05-01T15:16:06Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00226,
  "epssPercentile": 0.13405,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.0.10-1",
      "fix": "DEBIAN-CVE-2022-49826",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49826",
      "released": "2025-05-01T15:16:06Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.0.10-1",
      "fix": "DEBIAN-CVE-2022-49826",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49826",
      "released": "2025-05-01T15:16:06Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.0.10-1",
      "fix": "DEBIAN-CVE-2022-49826",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49826",
      "released": "2025-05-01T15:16:06Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}