CVE-2022-49940

tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf()

MEDIUM
5.5
CVSS Score
Published: June 18, 2025 at 10:54 AM UTC
Updated: June 17, 2026 at 05:19 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf() A null pointer dereference can happen when attempting to access the "gsm->receive()" function in gsmld_receive_buf(). Currently, the code assumes that gsm->recieve is only called after MUX activation. Since the gsmld_receive_buf() function can be accessed without the need to initialize the MUX, the gsm->receive() function will not be set and a NULL pointer dereference will occur. Fix this by avoiding the call to "gsm->receive()" in case the function is not initialized by adding a sanity check. Call Trace: <TASK> gsmld_receive_buf+0x1c2/0x2f0 drivers/tty/n_gsm.c:2861 tiocsti drivers/tty/tty_io.c:2293 [inline] tty_ioctl+0xa75/0x15d0 drivers/tty/tty_io.c:2692 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

v ≥ 5.18.185.15.61 ≤ v < 5.15.665.18.18 ≤ v < 5.195.19.2 ≤ v < 5.19.81aecd917114577c423f7cec0d186ad7d76fc2dc1be365a70699f7dda92fd9e48b845460860705.15.615.18.185.19.25e59c010c6862da329db17acca086afd8bea1aa86.0 rc16.0 rc26.0 rc3b8faa754b523a845facdc83120b2ecd290d7fa6ddfa9b6d34aac2154b5e926d7a7a061123bf137c6
Vendor states this is fixed in 309aea4b6b813f6678c3a547cfd7fe3a76ffa976 (fixed)
Vendor states this is fixed in 5a82cf64f8ad63caf6bf115642ce44ddbc64311e (fixed)
Vendor states this is fixed in 5aa37f9510345a812c0998bcbbc4d88d1dcc4d8b (fixed)
Vendor states this is fixed in f16c6d2e58a4c2b972efcf9eb12390ee0ba3befb (fixed)
Affected range stops below 5.15.66, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.19, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.19.8, so it looks safe — our inference, not a vendor statement

References (4)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/309aea4b6b813f6678c3a547cfd7fe3a76ffa976
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/5a82cf64f8ad63caf6bf115642ce44ddbc64311e
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/5aa37f9510345a812c0998bcbbc4d88d1dcc4d8b
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f16c6d2e58a4c2b972efcf9eb12390ee0ba3befb

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card