{
  "cveId": "CVE-2022-49851",
  "url": "https://patchblox.com/security/cve/CVE-2022-49851",
  "summary": "CVE-2022-49851 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49851, released May 1, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  riscv: fix reserved memory setup  Currently, RIS...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  riscv: fix reserved memory setup  Currently, RISC-V sets up reserved memory using the \u0022early\u0022 copy of the device tree. As a result, when trying to get a reserved memory region using of_reserved_mem_lookup(), the pointer to reserved memory regions is using the early, pre-virtual-memory address which causes a kernel panic when trying to use the buffer\u0027s name:   Unable to handle kernel paging request at virtual address 00000000401c31ac  Oops [#1]  Modules linked in:  CPU: 0 PID: 0 Comm: swapper Not tainted 6.0.0-rc1-00001-g0d9d6953d834 #1  Hardware name: Microchip PolarFire-SoC Icicle Kit (DT)  epc : string\u002B0x4a/0xea   ra : vsnprintf\u002B0x1e4/0x336  epc : ffffffff80335ea0 ra : ffffffff80338936 sp : ffffffff81203be0   gp : ffffffff812e0a98 tp : ffffffff8120de40 t0 : 0000000000000000   t1 : ffffffff81203e28 t2 : 7265736572203a46 s0 : ffffffff81203c20   s1 : ffffffff81203e28 a0 : ffffffff81203d22 a1 : 0000000000000000   a2 : ffffffff81203d08 a3 : 0000000081203d21 a4 : ffffffffffffffff   a5 : 00000000401c31ac a6 : ffff0a00ffffff04 a7 : ffffffffffffffff   s2 : ffffffff81203d08 s3 : ffffffff81203d00 s4 : 0000000000000008   s5 : ffffffff000000ff s6 : 0000000000ffffff s7 : 00000000ffffff00   s8 : ffffffff80d9821a s9 : ffffffff81203d22 s10: 0000000000000002   s11: ffffffff80d9821c t3 : ffffffff812f3617 t4 : ffffffff812f3617   t5 : ffffffff812f3618 t6 : ffffffff81203d08  status: 0000000200000100 badaddr: 00000000401c31ac cause: 000000000000000d  [\u003Cffffffff80338936\u003E] vsnprintf\u002B0x1e4/0x336  [\u003Cffffffff80055ae2\u003E] vprintk_store\u002B0xf6/0x344  [\u003Cffffffff80055d86\u003E] vprintk_emit\u002B0x56/0x192  [\u003Cffffffff80055ed8\u003E] vprintk_default\u002B0x16/0x1e  [\u003Cffffffff800563d2\u003E] vprintk\u002B0x72/0x80  [\u003Cffffffff806813b2\u003E] _printk\u002B0x36/0x50  [\u003Cffffffff8068af48\u003E] print_reserved_mem\u002B0x1c/0x24  [\u003Cffffffff808057ec\u003E] paging_init\u002B0x528/0x5bc  [\u003Cffffffff808031ae\u003E] setup_arch\u002B0xd0/0x592  [\u003Cffffffff8080070e\u003E] start_kernel\u002B0x82/0x73c  early_init_fdt_scan_reserved_mem() takes no arguments as it operates on initial_boot_params, which is populated by early_init_dt_verify(). On RISC-V, early_init_dt_verify() is called twice. Once, directly, in setup_arch() if CONFIG_BUILTIN_DTB is not enabled and once indirectly, very early in the boot process, by parse_dtb() when it calls early_init_dt_scan_nodes().  This first call uses dtb_early_va to set initial_boot_params, which is not usable later in the boot process when early_init_fdt_scan_reserved_mem() is called. On arm64 for example, the corresponding call to early_init_dt_scan_nodes() uses fixmap addresses and doesn\u0027t suffer the same fate.  Move early_init_fdt_scan_reserved_mem() further along the boot sequence, after the direct call to early_init_dt_verify() in setup_arch() so that the names use the correct virtual memory addresses. The above supposed that CONFIG_BUILTIN_DTB was not set, but should work equally in the case where it is - unflatted_and_copy_device_tree() also updates initial_boot_params.",
  "published": "2025-05-01T15:16:08Z",
  "severity": "high",
  "cvss": 7.1,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
  "epss": 0.00207,
  "epssPercentile": 0.10826,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.0.10-1",
      "fix": "DEBIAN-CVE-2022-49851",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49851",
      "released": "2025-05-01T15:16:08Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.0.10-1",
      "fix": "DEBIAN-CVE-2022-49851",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49851",
      "released": "2025-05-01T15:16:08Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.0.10-1",
      "fix": "DEBIAN-CVE-2022-49851",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49851",
      "released": "2025-05-01T15:16:08Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}