GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49726 (GCVE-0-2022-49726)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:24 – Updated: 2026-05-11 19:05
VLAI
Title
clocksource: hyper-v: unexport __init-annotated hv_init_clocksource()
Summary
In the Linux kernel, the following vulnerability has been resolved: clocksource: hyper-v: unexport __init-annotated hv_init_clocksource() EXPORT_SYMBOL and __init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot use symbols annotated __init. The access to a freed symbol may end up with kernel panic. modpost used to detect it, but it has been broken for a decade. Recently, I fixed modpost so it started to warn it again, then this showed up in linux-next builds. There are two ways to fix it: - Remove __init - Remove EXPORT_SYMBOL I chose the latter for this case because the only in-tree call-site, arch/x86/kernel/cpu/mshyperv.c is never compiled as modular. (CONFIG_HYPERVISOR_GUEST is boolean)
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: dd2cb348613b44f9d948b068775e159aad298599 , < cff3a7ce6e81418b6e8bac941779bbf5d342d626 (git)
Affected: dd2cb348613b44f9d948b068775e159aad298599 , < db965e2757d95f695e606856418cd84003dd036d (git)
Affected: dd2cb348613b44f9d948b068775e159aad298599 , < 0414eab7c78f3518143d383e448d44fc573ac6d2 (git)
Affected: dd2cb348613b44f9d948b068775e159aad298599 , < 937fcbb55a1e48a6422e87e8f49422c92265f102 (git)
Affected: dd2cb348613b44f9d948b068775e159aad298599 , < 245b993d8f6c4e25f19191edfbd8080b645e12b1 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.3
Unaffected: 0 , < 5.3 (semver)
Unaffected: 5.4.200 , ≤ 5.4.* (semver)
Unaffected: 5.10.124 , ≤ 5.10.* (semver)
Unaffected: 5.15.49 , ≤ 5.15.* (semver)
Unaffected: 5.18.6 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/clocksource/hyperv_timer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cff3a7ce6e81418b6e8bac941779bbf5d342d626",
              "status": "affected",
              "version": "dd2cb348613b44f9d948b068775e159aad298599",
              "versionType": "git"
            },
            {
              "lessThan": "db965e2757d95f695e606856418cd84003dd036d",
              "status": "affected",
              "version": "dd2cb348613b44f9d948b068775e159aad298599",
              "versionType": "git"
            },
            {
              "lessThan": "0414eab7c78f3518143d383e448d44fc573ac6d2",
              "status": "affected",
              "version": "dd2cb348613b44f9d948b068775e159aad298599",
              "versionType": "git"
            },
            {
              "lessThan": "937fcbb55a1e48a6422e87e8f49422c92265f102",
              "status": "affected",
              "version": "dd2cb348613b44f9d948b068775e159aad298599",
              "versionType": "git"
            },
            {
              "lessThan": "245b993d8f6c4e25f19191edfbd8080b645e12b1",
              "status": "affected",
              "version": "dd2cb348613b44f9d948b068775e159aad298599",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/clocksource/hyperv_timer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.200",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.124",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.200",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.124",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.49",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.6",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclocksource: hyper-v: unexport __init-annotated hv_init_clocksource()\n\nEXPORT_SYMBOL and __init is a bad combination because the .init.text\nsection is freed up after the initialization. Hence, modules cannot\nuse symbols annotated __init. The access to a freed symbol may end up\nwith kernel panic.\n\nmodpost used to detect it, but it has been broken for a decade.\n\nRecently, I fixed modpost so it started to warn it again, then this\nshowed up in linux-next builds.\n\nThere are two ways to fix it:\n\n  - Remove __init\n  - Remove EXPORT_SYMBOL\n\nI chose the latter for this case because the only in-tree call-site,\narch/x86/kernel/cpu/mshyperv.c is never compiled as modular.\n(CONFIG_HYPERVISOR_GUEST is boolean)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:05:39.715Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cff3a7ce6e81418b6e8bac941779bbf5d342d626"
        },
        {
          "url": "https://git.kernel.org/stable/c/db965e2757d95f695e606856418cd84003dd036d"
        },
        {
          "url": "https://git.kernel.org/stable/c/0414eab7c78f3518143d383e448d44fc573ac6d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/937fcbb55a1e48a6422e87e8f49422c92265f102"
        },
        {
          "url": "https://git.kernel.org/stable/c/245b993d8f6c4e25f19191edfbd8080b645e12b1"
        }
      ],
      "title": "clocksource: hyper-v: unexport __init-annotated hv_init_clocksource()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49726",
    "datePublished": "2025-02-26T02:24:38.003Z",
    "dateReserved": "2025-02-26T02:21:30.448Z",
    "dateUpdated": "2026-05-11T19:05:39.715Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49726",
      "date": "2026-09-16",
      "epss": "0.00273",
      "percentile": "0.19778"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49726\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:48.257\",\"lastModified\":\"2026-06-17T05:18:58.783\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nclocksource: hyper-v: unexport __init-annotated hv_init_clocksource()\\n\\nEXPORT_SYMBOL and __init is a bad combination because the .init.text\\nsection is freed up after the initialization. Hence, modules cannot\\nuse symbols annotated __init. The access to a freed symbol may end up\\nwith kernel panic.\\n\\nmodpost used to detect it, but it has been broken for a decade.\\n\\nRecently, I fixed modpost so it started to warn it again, then this\\nshowed up in linux-next builds.\\n\\nThere are two ways to fix it:\\n\\n  - Remove __init\\n  - Remove EXPORT_SYMBOL\\n\\nI chose the latter for this case because the only in-tree call-site,\\narch/x86/kernel/cpu/mshyperv.c is never compiled as modular.\\n(CONFIG_HYPERVISOR_GUEST is boolean)\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: clocksource: hyper-v: unexport __init-annotated hv_init_clocksource() EXPORT_SYMBOL y __init es una mala combinaci\u00f3n porque la secci\u00f3n .init.text se libera despu\u00e9s de la inicializaci\u00f3n. Por lo tanto, los m\u00f3dulos no pueden usar s\u00edmbolos anotados __init. El acceso a un s\u00edmbolo liberado puede terminar con un p\u00e1nico del kernel. modpost sol\u00eda detectarlo, pero ha estado roto durante una d\u00e9cada. Recientemente, arregl\u00e9 modpost para que comenzara a advertirlo nuevamente, luego apareci\u00f3 en las compilaciones de linux-next. Hay dos formas de solucionarlo: - Eliminar __init - Eliminar EXPORT_SYMBOL Eleg\u00ed la \u00faltima para este caso porque el \u00fanico sitio de llamada en el \u00e1rbol, arch/x86/kernel/cpu/mshyperv.c nunca se compila como modular. (CONFIG_HYPERVISOR_GUEST es booleano)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/clocksource/hyperv_timer.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"dd2cb348613b44f9d948b068775e159aad298599\",\"lessThan\":\"cff3a7ce6e81418b6e8bac941779bbf5d342d626\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dd2cb348613b44f9d948b068775e159aad298599\",\"lessThan\":\"db965e2757d95f695e606856418cd84003dd036d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dd2cb348613b44f9d948b068775e159aad298599\",\"lessThan\":\"0414eab7c78f3518143d383e448d44fc573ac6d2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dd2cb348613b44f9d948b068775e159aad298599\",\"lessThan\":\"937fcbb55a1e48a6422e87e8f49422c92265f102\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dd2cb348613b44f9d948b068775e159aad298599\",\"lessThan\":\"245b993d8f6c4e25f19191edfbd8080b645e12b1\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/clocksource/hyperv_timer.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.200\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.124\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.49\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18.6\",\"lessThanOrEqual\":\"5.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-908\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.3\",\"versionEndExcluding\":\"5.4.200\",\"matchCriteriaId\":\"06C9BEC4-FEF8-4616-9D9C-AA0A09A1938D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.124\",\"matchCriteriaId\":\"6442F2CD-FF1C-4574-9948-138835E635D7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.49\",\"matchCriteriaId\":\"697D250E-E0A4-41BE-BB54-96385E129206\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.18.6\",\"matchCriteriaId\":\"CDD33A19-B51E-4090-A47B-073098916815\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"A8C30C2D-F82D-4D37-AB48-D76ABFBD5377\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"BF8547FC-C849-4F1B-804B-A93AE2F04A92\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0414eab7c78f3518143d383e448d44fc573ac6d2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/245b993d8f6c4e25f19191edfbd8080b645e12b1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/937fcbb55a1e48a6422e87e8f49422c92265f102\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cff3a7ce6e81418b6e8bac941779bbf5d342d626\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/db965e2757d95f695e606856418cd84003dd036d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T21:16:28+00:00",
      "cve": "CVE-2022-49726",
      "id": "CVE-2022-49726",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "321",
      "product_status:known_affected": "38",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: clocksource: hyper-v: unexport __init-annotated hv_init_clocksource()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49726.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T01:26:29Z",
      "cve": "CVE-2022-49726",
      "id": "CVE-2022-49726",
      "initial_release_date": "2025-02-27T03:02:11Z",
      "product_status:known_affected": "411",
      "product_status:known_not_affected": "270",
      "product_status:recommended": "270",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49726",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49726.json",
      "version": "68"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.