CVE-2022-49302
USB: host: isp116x: check return value after calling platform_get_resource()
MEDIUM
5.5
CVSS Score
Published: February 26, 2025 at 02:10 AM UTC
Updated: June 17, 2026 at 05:17 AM UTC
1 product affected across 1 vendorLinux Kernel
Using Linux by Linux?
Get instant alerts when new vulnerabilities affect Linux - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.3%
SSVC
No known exploit
Description
In the Linux kernel, the following vulnerability has been resolved: USB: host: isp116x: check return value after calling platform_get_resource() It will cause null-ptr-deref if platform_get_resource() returns NULL, we need check the return value.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
v < 4.9.3182.6.13 ≤ v < 4.14.2832.6.13 ≤ v < 4.19.2472.6.13 ≤ v < 4.9.3182.6.13 ≤ v < 5.10.1222.6.13 ≤ v < 5.15.472.6.13 ≤ v < 5.17.152.6.13 ≤ v < 5.18.42.6.13 ≤ v < 5.192.6.13 ≤ v < 5.4.1984.10 ≤ v < 4.14.2834.15 ≤ v < 4.19.2474.20 ≤ v < 5.4.1985.11 ≤ v < 5.15.475.16 ≤ v < 5.17.155.18 ≤ v < 5.18.45.5 ≤ v < 5.10.1222.6.134808a1c0261176f9c7e28e7f108d41a381a7d0fc
Vendor states this is fixed in 134a3408c2d3f7e23eb0e4556e0a2d9f36c2614e (fixed)
Vendor states this is fixed in 3592cfd8b848bf0c4d7740d78a87a7b8f6e1fa9a (fixed)
Vendor states this is fixed in 3825db88d8c704e7992b685618a03f82bffcf2ef (fixed)
Vendor states this is fixed in 7bffda1560a6f255fdf504e059fbbdb5d46b9e44 (fixed)
Vendor states this is fixed in 804de302ada3544699c5f48c5314b249af76faa3 (fixed)
Vendor states this is fixed in 82a101f14943f479fd190b1e5b40d91c77e2ac1b (fixed)
Vendor states this is fixed in aca0cab0e9ed33b6371aafb519a6c38f2850ffc3 (fixed)
Vendor states this is fixed in c91a74b1f0f2d2d7e728742ae55e3ffe9ba7853d (fixed)
Vendor states this is fixed in ee105039d3653444de4d3ede642383c92855dc1e (fixed)
Vendor states this is fixed in 2.6.13 (unaffected)
Vendor states this is fixed in 4.14.283 (unaffected)
Vendor states this is fixed in 4.19.247 (unaffected)
Vendor states this is fixed in 4.9.318 (unaffected)
Vendor states this is fixed in 5.10.122 (unaffected)
Vendor states this is fixed in 5.15.47 (unaffected)
Vendor states this is fixed in 5.17.15 (unaffected)
Vendor states this is fixed in 5.18.4 (unaffected)
Vendor states this is fixed in 5.19 (unaffected)
Vendor states this is fixed in 5.4.198 (unaffected)
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- https://git.kernel.org/stable/c/134a3408c2d3f7e23eb0e4556e0a2d9f36c2614e
- https://git.kernel.org/stable/c/3592cfd8b848bf0c4d7740d78a87a7b8f6e1fa9a
- https://git.kernel.org/stable/c/3825db88d8c704e7992b685618a03f82bffcf2ef
- https://git.kernel.org/stable/c/7bffda1560a6f255fdf504e059fbbdb5d46b9e44
- https://git.kernel.org/stable/c/804de302ada3544699c5f48c5314b249af76faa3
References (9)
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/134a3408c2d3f7e23eb0e4556e0a2d9f36c2614ePatch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3592cfd8b848bf0c4d7740d78a87a7b8f6e1fa9aPatch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3825db88d8c704e7992b685618a03f82bffcf2efPatch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/7bffda1560a6f255fdf504e059fbbdb5d46b9e44Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/804de302ada3544699c5f48c5314b249af76faa3Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/82a101f14943f479fd190b1e5b40d91c77e2ac1bPatch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/aca0cab0e9ed33b6371aafb519a6c38f2850ffc3Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c91a74b1f0f2d2d7e728742ae55e3ffe9ba7853dSSVC — Action Prioritization
SSVCNo known exploitNot automatablePartial impact
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
5.5MEDIUMCISA-ADP
- Attack Vector
- LOCAL
- Complexity
- LOW
- Privileges
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- NONE
- Integrity
- NONE
- Availability
- HIGH
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-476
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card