CVE-2022-49960
BaseFortify
Publication date: 2025-06-18
Last updated on: 2025-11-14
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.0 |
| linux | linux_kernel | 6.0 |
| linux | linux_kernel | 6.0 |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a null pointer dereference in the Linux kernel's Intel graphics driver (drm/i915). Specifically, it occurs in the function tgl_get_bw_info() within the intel_bw.c file, causing the system to crash (kernel panic) during boot on affected hardware such as the Asus Chromebook CX550 running kernel version 5.17-rc1. The null pointer dereference happens when the code attempts to access bi_next, which is not properly initialized, leading to a fatal exception and system crash.
How can this vulnerability impact me? :
This vulnerability can cause the affected Linux system to crash during boot, resulting in a denial of service. Specifically, devices like the Asus Chromebook CX550 may fail to start properly, leading to system instability and inability to use the device until the kernel is patched or updated to fix the null pointer dereference.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a kernel NULL pointer dereference causing system crashes or kernel panics during boot, particularly related to the i915 driver in the Linux kernel. Detection involves monitoring system logs for kernel oops or panic messages referencing 'tgl_get_bw_info', 'intel_bw_init_hw', or 'i915_driver_probe'. You can check the kernel logs using commands like 'dmesg | grep -i i915' or 'journalctl -k | grep -i oops' to identify related errors.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where the null pointer dereference in the i915 driver has been fixed (post v5.17-rc1). If an update is not immediately possible, consider disabling the i915 driver or using kernel boot parameters to prevent loading the affected driver until a patch is applied.