CVE-2022-49824

ata: libata-transport: fix error handling in ata_tlink_add()

MEDIUM
5.5
CVSS Score
Published: May 1, 2025 at 02:09 PM UTC
Updated: June 17, 2026 at 05:19 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: ata: libata-transport: fix error handling in ata_tlink_add() In ata_tlink_add(), the return value of transport_add_device() is not checked. As a result, it causes null-ptr-deref while removing the module, because transport_remove_device() is called to remove the device that was not added. Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0 CPU: 33 PID: 13850 Comm: rmmod Kdump: loaded Tainted: G W 6.1.0-rc3+ #12 pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : device_del+0x48/0x39c lr : device_del+0x44/0x39c Call trace: device_del+0x48/0x39c attribute_container_class_device_del+0x28/0x40 transport_remove_classdev+0x60/0x7c attribute_container_device_trigger+0x118/0x120 transport_remove_device+0x20/0x30 ata_tlink_delete+0x88/0xb0 [libata] ata_tport_delete+0x2c/0x60 [libata] ata_port_detach+0x148/0x1b0 [libata] ata_pci_remove_one+0x50/0x80 [libata] ahci_remove_one+0x4c/0x8c [ahci] Fix this by checking and handling return value of transport_add_device() in ata_tlink_add().

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

2.6.37 ≤ v < 5.10.1562.6.37 ≤ v < 5.15.802.6.37 ≤ v < 6.0.102.6.37 ≤ v < 6.15.11 ≤ v < 5.15.805.16 ≤ v < 6.0.102.6.376.1 rc16.1 rc26.1 rc36.1 rc4d9027470b88631d0956ac37cdadfdeb9cdcf2c99
Vendor states this is fixed in 67b219314628b90b3a314528e177335b0cd5c70b (fixed)
Vendor states this is fixed in 7377a14598f6b04446c54bc4a50cd249470d6c6f (fixed)
Vendor states this is fixed in cf0816f6322c5c37ee52655f928e91ecf32da103 (fixed)
Vendor states this is fixed in d5234480ca822bdcf03fe4d6a590ddcb854558f7 (fixed)
Vendor states this is fixed in 2.6.37 (unaffected)
Vendor states this is fixed in 5.10.156 (unaffected)
Vendor states this is fixed in 5.15.80 (unaffected)
Vendor states this is fixed in 6.0.10 (unaffected)
Vendor states this is fixed in 6.1 (unaffected)

References (4)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/67b219314628b90b3a314528e177335b0cd5c70b
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/7377a14598f6b04446c54bc4a50cd249470d6c6f
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/cf0816f6322c5c37ee52655f928e91ecf32da103
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d5234480ca822bdcf03fe4d6a590ddcb854558f7

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card