GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49254 (GCVE-0-2022-49254)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:56 – Updated: 2026-05-11 18:56
VLAI
Title
media: ti-vpe: cal: Fix a NULL pointer dereference in cal_ctx_v4l2_init_formats()
Summary
In the Linux kernel, the following vulnerability has been resolved: media: ti-vpe: cal: Fix a NULL pointer dereference in cal_ctx_v4l2_init_formats() In cal_ctx_v4l2_init_formats(), devm_kzalloc() is assigned to ctx->active_fmt and there is a dereference of it after that, which could lead to NULL pointer dereference on failure of devm_kzalloc(). Fix this bug by adding a NULL check of ctx->active_fmt. This bug was found by a static analyzer. Builds with 'make allyesconfig' show no new warnings, and our static analyzer no longer warns about this code.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7168155002cf7aadbfaa14a28f037c880a214764 , < aa613ac270292e102503e9767882e39200efe608 (git)
Affected: 7168155002cf7aadbfaa14a28f037c880a214764 , < 91e2805579ab0783eed53acc2bf9fb553e939004 (git)
Affected: 7168155002cf7aadbfaa14a28f037c880a214764 , < 1381f1a629a090c251965edb56f849ad648414a4 (git)
Affected: 7168155002cf7aadbfaa14a28f037c880a214764 , < abd77889851d2ead0d0c9c4d29f1808801477b00 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.12
Unaffected: 0 , < 5.12 (semver)
Unaffected: 5.15.33 , ≤ 5.15.* (semver)
Unaffected: 5.16.19 , ≤ 5.16.* (semver)
Unaffected: 5.17.2 , ≤ 5.17.* (semver)
Unaffected: 5.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/ti-vpe/cal-video.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aa613ac270292e102503e9767882e39200efe608",
              "status": "affected",
              "version": "7168155002cf7aadbfaa14a28f037c880a214764",
              "versionType": "git"
            },
            {
              "lessThan": "91e2805579ab0783eed53acc2bf9fb553e939004",
              "status": "affected",
              "version": "7168155002cf7aadbfaa14a28f037c880a214764",
              "versionType": "git"
            },
            {
              "lessThan": "1381f1a629a090c251965edb56f849ad648414a4",
              "status": "affected",
              "version": "7168155002cf7aadbfaa14a28f037c880a214764",
              "versionType": "git"
            },
            {
              "lessThan": "abd77889851d2ead0d0c9c4d29f1808801477b00",
              "status": "affected",
              "version": "7168155002cf7aadbfaa14a28f037c880a214764",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/ti-vpe/cal-video.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.33",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.19",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.2",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ti-vpe: cal: Fix a NULL pointer dereference in cal_ctx_v4l2_init_formats()\n\nIn cal_ctx_v4l2_init_formats(), devm_kzalloc() is assigned to\nctx-\u003eactive_fmt and there is a dereference of it after that, which could\nlead to NULL pointer dereference on failure of devm_kzalloc().\n\nFix this bug by adding a NULL check of ctx-\u003eactive_fmt.\n\nThis bug was found by a static analyzer.\n\nBuilds with \u0027make allyesconfig\u0027 show no new warnings, and our static\nanalyzer no longer warns about this code."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:56:09.147Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aa613ac270292e102503e9767882e39200efe608"
        },
        {
          "url": "https://git.kernel.org/stable/c/91e2805579ab0783eed53acc2bf9fb553e939004"
        },
        {
          "url": "https://git.kernel.org/stable/c/1381f1a629a090c251965edb56f849ad648414a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/abd77889851d2ead0d0c9c4d29f1808801477b00"
        }
      ],
      "title": "media: ti-vpe: cal: Fix a NULL pointer dereference in cal_ctx_v4l2_init_formats()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49254",
    "datePublished": "2025-02-26T01:56:09.619Z",
    "dateReserved": "2025-02-26T01:49:39.295Z",
    "dateUpdated": "2026-05-11T18:56:09.147Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49254",
      "date": "2026-09-20",
      "epss": "0.00263",
      "percentile": "0.18488"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/platform/ti-vpe/cal-video.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "aa613ac270292e102503e9767882e39200efe608",
                    "status": "affected",
                    "version": "7168155002cf7aadbfaa14a28f037c880a214764",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "91e2805579ab0783eed53acc2bf9fb553e939004",
                    "status": "affected",
                    "version": "7168155002cf7aadbfaa14a28f037c880a214764",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1381f1a629a090c251965edb56f849ad648414a4",
                    "status": "affected",
                    "version": "7168155002cf7aadbfaa14a28f037c880a214764",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "abd77889851d2ead0d0c9c4d29f1808801477b00",
                    "status": "affected",
                    "version": "7168155002cf7aadbfaa14a28f037c880a214764",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/platform/ti-vpe/cal-video.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.12"
                  },
                  {
                    "lessThan": "5.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.33",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.16.*",
                    "status": "unaffected",
                    "version": "5.16.19",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.17.*",
                    "status": "unaffected",
                    "version": "5.17.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "02AF1052-DC50-47B3-B1DE-638E4BBDCCD1",
                    "versionEndExcluding": "5.15.33",
                    "versionStartIncluding": "5.12",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "20C43679-0439-405A-B97F-685BEE50613B",
                    "versionEndExcluding": "5.16.19",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "210C679C-CF84-44A3-8939-E629C87E54BF",
                    "versionEndExcluding": "5.17.2",
                    "versionStartIncluding": "5.17",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ti-vpe: cal: Fix a NULL pointer dereference in cal_ctx_v4l2_init_formats()\n\nIn cal_ctx_v4l2_init_formats(), devm_kzalloc() is assigned to\nctx-\u003eactive_fmt and there is a dereference of it after that, which could\nlead to NULL pointer dereference on failure of devm_kzalloc().\n\nFix this bug by adding a NULL check of ctx-\u003eactive_fmt.\n\nThis bug was found by a static analyzer.\n\nBuilds with \u0027make allyesconfig\u0027 show no new warnings, and our static\nanalyzer no longer warns about this code."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: media: ti-vpe: cal: Se corrige una desreferencia de puntero NULL en cal_ctx_v4l2_init_formats() En cal_ctx_v4l2_init_formats(), devm_kzalloc() se asigna a ctx-\u0026gt;active_fmt y hay una desreferencia de este despu\u00e9s de eso, lo que podr\u00eda provocar una desreferencia de puntero NULL en caso de fallo de devm_kzalloc(). Corrija este error agregando una comprobaci\u00f3n NULL de ctx-\u0026gt;active_fmt. Este error fue encontrado por un analizador est\u00e1tico. Las compilaciones con \u0027make allyesconfig\u0027 no muestran nuevas advertencias y nuestro analizador est\u00e1tico ya no advierte sobre este c\u00f3digo."
          }
        ],
        "id": "CVE-2022-49254",
        "lastModified": "2026-06-17T05:17:31.213",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-02-26T07:01:02.300",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1381f1a629a090c251965edb56f849ad648414a4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/91e2805579ab0783eed53acc2bf9fb553e939004"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/aa613ac270292e102503e9767882e39200efe608"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/abd77889851d2ead0d0c9c4d29f1808801477b00"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-476"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:13:17+00:00",
      "cve": "CVE-2022-49254",
      "id": "CVE-2022-49254",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: media: ti-vpe: cal: Fix a NULL pointer dereference in cal_ctx_v4l2_init_formats()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49254.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T02:29:20Z",
      "cve": "CVE-2022-49254",
      "id": "CVE-2022-49254",
      "initial_release_date": "2025-02-27T03:09:55Z",
      "product_status:known_affected": "334",
      "product_status:known_not_affected": "404",
      "product_status:recommended": "223",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49254",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49254.json",
      "version": "45"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.