{
  "cveId": "CVE-2022-49916",
  "url": "https://patchblox.com/security/cve/CVE-2022-49916",
  "summary": "CVE-2022-49916 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49916, released May 1, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  rose: Fix NULL pointer dereference in rose_send_...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  rose: Fix NULL pointer dereference in rose_send_frame()  The syzkaller reported an issue:  KASAN: null-ptr-deref in range [0x0000000000000380-0x0000000000000387] CPU: 0 PID: 4069 Comm: kworker/0:15 Not tainted 6.0.0-syzkaller-02734-g0326074ff465 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Workqueue: rcu_gp srcu_invoke_callbacks RIP: 0010:rose_send_frame\u002B0x1dd/0x2f0 net/rose/rose_link.c:101 Call Trace:  \u003CIRQ\u003E  rose_transmit_clear_request\u002B0x1d5/0x290 net/rose/rose_link.c:255  rose_rx_call_request\u002B0x4c0/0x1bc0 net/rose/af_rose.c:1009  rose_loopback_timer\u002B0x19e/0x590 net/rose/rose_loopback.c:111  call_timer_fn\u002B0x1a0/0x6b0 kernel/time/timer.c:1474  expire_timers kernel/time/timer.c:1519 [inline]  __run_timers.part.0\u002B0x674/0xa80 kernel/time/timer.c:1790  __run_timers kernel/time/timer.c:1768 [inline]  run_timer_softirq\u002B0xb3/0x1d0 kernel/time/timer.c:1803  __do_softirq\u002B0x1d0/0x9c8 kernel/softirq.c:571  [...]  \u003C/IRQ\u003E  It triggers NULL pointer dereference when \u0027neigh-\u003Edev-\u003Edev_addr\u0027 is called in the rose_send_frame(). It\u0027s the first occurrence of the \u0060neigh\u0060 is in rose_loopback_timer() as \u0060rose_loopback_neigh\u0027, and the \u0027dev\u0027 in \u0027rose_loopback_neigh\u0027 is initialized sa nullptr.  It had been fixed by commit 3b3fd068c56e3fbea30090859216a368398e39bf (\u0022rose: Fix Null pointer dereference in rose_send_frame()\u0022) ever. But it\u0027s introduced by commit 3c53cd65dece47dd1f9d3a809f32e59d1d87b2b8 (\u0022rose: check NULL rose_loopback_neigh-\u003Eloopback\u0022) again.  We fix it by add NULL check in rose_transmit_clear_request(). When the \u0027dev\u0027 in \u0027neigh\u0027 is NULL, we don\u0027t reply the request and just clear it.  syzkaller don\u0027t provide repro, and I provide a syz repro like: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, \u0026(0x7f0000000180)={\u0027rose0\\x00\u0027, 0x201}) r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0) bind$rose(r1, \u0026(0x7f00000000c0)=@full={0xb, @dev, @null, 0x0, [@null, @null, @netrom, @netrom, @default, @null]}, 0x40) connect$rose(r1, \u0026(0x7f0000000240)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}}, 0x1c)",
  "published": "2025-05-01T15:16:16Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.0019,
  "epssPercentile": 0.08678,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.0.8-1",
      "fix": "DEBIAN-CVE-2022-49916",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49916",
      "released": "2025-05-01T15:16:16Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.0.8-1",
      "fix": "DEBIAN-CVE-2022-49916",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49916",
      "released": "2025-05-01T15:16:16Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.0.8-1",
      "fix": "DEBIAN-CVE-2022-49916",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49916",
      "released": "2025-05-01T15:16:16Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}