GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49977 (GCVE-0-2022-49977)

Vulnerability from cvelistv5 – Published: 2025-06-18 11:00 – Updated: 2026-08-05 08:56
VLAI
Title
ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead
Summary
In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead ftrace_startup does not remove ops from ftrace_ops_list when ftrace_startup_enable fails: register_ftrace_function ftrace_startup __register_ftrace_function ... add_ftrace_ops(&ftrace_ops_list, ops) ... ... ftrace_startup_enable // if ftrace failed to modify, ftrace_disabled is set to 1 ... return 0 // ops is in the ftrace_ops_list. When ftrace_disabled = 1, unregister_ftrace_function simply returns without doing anything: unregister_ftrace_function ftrace_shutdown if (unlikely(ftrace_disabled)) return -ENODEV; // return here, __unregister_ftrace_function is not executed, // as a result, ops is still in the ftrace_ops_list __unregister_ftrace_function ... If ops is dynamically allocated, it will be free later, in this case, is_ftrace_trampoline accesses NULL pointer: is_ftrace_trampoline ftrace_ops_trampoline do_for_each_ftrace_op(op, ftrace_ops_list) // OOPS! op may be NULL! Syzkaller reports as follows: [ 1203.506103] BUG: kernel NULL pointer dereference, address: 000000000000010b [ 1203.508039] #PF: supervisor read access in kernel mode [ 1203.508798] #PF: error_code(0x0000) - not-present page [ 1203.509558] PGD 800000011660b067 P4D 800000011660b067 PUD 130fb8067 PMD 0 [ 1203.510560] Oops: 0000 [#1] SMP KASAN PTI [ 1203.511189] CPU: 6 PID: 29532 Comm: syz-executor.2 Tainted: G B W 5.10.0 #8 [ 1203.512324] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 1203.513895] RIP: 0010:is_ftrace_trampoline+0x26/0xb0 [ 1203.514644] Code: ff eb d3 90 41 55 41 54 49 89 fc 55 53 e8 f2 00 fd ff 48 8b 1d 3b 35 5d 03 e8 e6 00 fd ff 48 8d bb 90 00 00 00 e8 2a 81 26 00 <48> 8b ab 90 00 00 00 48 85 ed 74 1d e8 c9 00 fd ff 48 8d bb 98 00 [ 1203.518838] RSP: 0018:ffffc900012cf960 EFLAGS: 00010246 [ 1203.520092] RAX: 0000000000000000 RBX: 000000000000007b RCX: ffffffff8a331866 [ 1203.521469] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000000000000010b [ 1203.522583] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8df18b07 [ 1203.523550] R10: fffffbfff1be3160 R11: 0000000000000001 R12: 0000000000478399 [ 1203.524596] R13: 0000000000000000 R14: ffff888145088000 R15: 0000000000000008 [ 1203.525634] FS: 00007f429f5f4700(0000) GS:ffff8881daf00000(0000) knlGS:0000000000000000 [ 1203.526801] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1203.527626] CR2: 000000000000010b CR3: 0000000170e1e001 CR4: 00000000003706e0 [ 1203.528611] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1203.529605] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Therefore, when ftrace_startup_enable fails, we need to rollback registration process and remove ops from ftrace_ops_list.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8a56d7761d2d041ae5e8215d20b4167d8aa93f51 , < 8569b4ada1e0b9bfaa125bd0c0967918b6560fa2 (git)
Affected: 8a56d7761d2d041ae5e8215d20b4167d8aa93f51 , < 4c34a2a6c9927c239dd2e295a03d49b37b618d2c (git)
Affected: 8a56d7761d2d041ae5e8215d20b4167d8aa93f51 , < ddffe882d74ef43a3494f0ab0c24baf076c45f96 (git)
Affected: 8a56d7761d2d041ae5e8215d20b4167d8aa93f51 , < 934e49f7d696afdae9f979abe3f308408184e17b (git)
Affected: 8a56d7761d2d041ae5e8215d20b4167d8aa93f51 , < dbd8c8fc60480e3faa3ae7e27ebe03371ecd1b77 (git)
Affected: 8a56d7761d2d041ae5e8215d20b4167d8aa93f51 , < e4ae97295984ff1b9b340ed18ae1b066f36b7835 (git)
Affected: 8a56d7761d2d041ae5e8215d20b4167d8aa93f51 , < d81bd6671f45fde4c3ac7fd7733c6e3082ae9d8e (git)
Affected: 8a56d7761d2d041ae5e8215d20b4167d8aa93f51 , < c3b0f72e805f0801f05fa2aa52011c4bfc694c44 (git)
Affected: 969a08e9048ddd0d655a19e692673cdb95116ce6 (git)
Affected: 51d351d5b949ae7204696ada7ef502ed34d34fb0 (git)
Affected: 2940c25bec92f40a3f7f32504b8ea115d1701892 (git)
Affected: 189f4e672fc1c086f78818affc810ef29dda42a3 (git)
Affected: 3.2.54 , < 3.3 (semver)
Affected: 3.4.72 , < 3.5 (semver)
Affected: 3.10.22 , < 3.11 (semver)
Affected: 3.12.3 , < 3.13 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 3.13
Unaffected: 0 , < 3.13 (semver)
Unaffected: 4.9.327 , ≤ 4.9.* (semver)
Unaffected: 4.14.292 , ≤ 4.14.* (semver)
Unaffected: 4.19.257 , ≤ 4.19.* (semver)
Unaffected: 5.4.212 , ≤ 5.4.* (semver)
Unaffected: 5.10.141 , ≤ 5.10.* (semver)
Unaffected: 5.15.65 , ≤ 5.15.* (semver)
Unaffected: 5.19.7 , ≤ 5.19.* (semver)
Unaffected: 6.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ftrace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8569b4ada1e0b9bfaa125bd0c0967918b6560fa2",
              "status": "affected",
              "version": "8a56d7761d2d041ae5e8215d20b4167d8aa93f51",
              "versionType": "git"
            },
            {
              "lessThan": "4c34a2a6c9927c239dd2e295a03d49b37b618d2c",
              "status": "affected",
              "version": "8a56d7761d2d041ae5e8215d20b4167d8aa93f51",
              "versionType": "git"
            },
            {
              "lessThan": "ddffe882d74ef43a3494f0ab0c24baf076c45f96",
              "status": "affected",
              "version": "8a56d7761d2d041ae5e8215d20b4167d8aa93f51",
              "versionType": "git"
            },
            {
              "lessThan": "934e49f7d696afdae9f979abe3f308408184e17b",
              "status": "affected",
              "version": "8a56d7761d2d041ae5e8215d20b4167d8aa93f51",
              "versionType": "git"
            },
            {
              "lessThan": "dbd8c8fc60480e3faa3ae7e27ebe03371ecd1b77",
              "status": "affected",
              "version": "8a56d7761d2d041ae5e8215d20b4167d8aa93f51",
              "versionType": "git"
            },
            {
              "lessThan": "e4ae97295984ff1b9b340ed18ae1b066f36b7835",
              "status": "affected",
              "version": "8a56d7761d2d041ae5e8215d20b4167d8aa93f51",
              "versionType": "git"
            },
            {
              "lessThan": "d81bd6671f45fde4c3ac7fd7733c6e3082ae9d8e",
              "status": "affected",
              "version": "8a56d7761d2d041ae5e8215d20b4167d8aa93f51",
              "versionType": "git"
            },
            {
              "lessThan": "c3b0f72e805f0801f05fa2aa52011c4bfc694c44",
              "status": "affected",
              "version": "8a56d7761d2d041ae5e8215d20b4167d8aa93f51",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "969a08e9048ddd0d655a19e692673cdb95116ce6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "51d351d5b949ae7204696ada7ef502ed34d34fb0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2940c25bec92f40a3f7f32504b8ea115d1701892",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "189f4e672fc1c086f78818affc810ef29dda42a3",
              "versionType": "git"
            },
            {
              "lessThan": "3.3",
              "status": "affected",
              "version": "3.2.54",
              "versionType": "semver"
            },
            {
              "lessThan": "3.5",
              "status": "affected",
              "version": "3.4.72",
              "versionType": "semver"
            },
            {
              "lessThan": "3.11",
              "status": "affected",
              "version": "3.10.22",
              "versionType": "semver"
            },
            {
              "lessThan": "3.13",
              "status": "affected",
              "version": "3.12.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ftrace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.327",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.292",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.257",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.65",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.327",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.292",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.257",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.212",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.141",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.65",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.7",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.2.54",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.4.72",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.10.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.12.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead\n\nftrace_startup does not remove ops from ftrace_ops_list when\nftrace_startup_enable fails:\n\nregister_ftrace_function\n  ftrace_startup\n    __register_ftrace_function\n      ...\n      add_ftrace_ops(\u0026ftrace_ops_list, ops)\n      ...\n    ...\n    ftrace_startup_enable // if ftrace failed to modify, ftrace_disabled is set to 1\n    ...\n  return 0 // ops is in the ftrace_ops_list.\n\nWhen ftrace_disabled = 1, unregister_ftrace_function simply returns without doing anything:\nunregister_ftrace_function\n  ftrace_shutdown\n    if (unlikely(ftrace_disabled))\n            return -ENODEV;  // return here, __unregister_ftrace_function is not executed,\n                             // as a result, ops is still in the ftrace_ops_list\n    __unregister_ftrace_function\n    ...\n\nIf ops is dynamically allocated, it will be free later, in this case,\nis_ftrace_trampoline accesses NULL pointer:\n\nis_ftrace_trampoline\n  ftrace_ops_trampoline\n    do_for_each_ftrace_op(op, ftrace_ops_list) // OOPS! op may be NULL!\n\nSyzkaller reports as follows:\n[ 1203.506103] BUG: kernel NULL pointer dereference, address: 000000000000010b\n[ 1203.508039] #PF: supervisor read access in kernel mode\n[ 1203.508798] #PF: error_code(0x0000) - not-present page\n[ 1203.509558] PGD 800000011660b067 P4D 800000011660b067 PUD 130fb8067 PMD 0\n[ 1203.510560] Oops: 0000 [#1] SMP KASAN PTI\n[ 1203.511189] CPU: 6 PID: 29532 Comm: syz-executor.2 Tainted: G    B   W         5.10.0 #8\n[ 1203.512324] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n[ 1203.513895] RIP: 0010:is_ftrace_trampoline+0x26/0xb0\n[ 1203.514644] Code: ff eb d3 90 41 55 41 54 49 89 fc 55 53 e8 f2 00 fd ff 48 8b 1d 3b 35 5d 03 e8 e6 00 fd ff 48 8d bb 90 00 00 00 e8 2a 81 26 00 \u003c48\u003e 8b ab 90 00 00 00 48 85 ed 74 1d e8 c9 00 fd ff 48 8d bb 98 00\n[ 1203.518838] RSP: 0018:ffffc900012cf960 EFLAGS: 00010246\n[ 1203.520092] RAX: 0000000000000000 RBX: 000000000000007b RCX: ffffffff8a331866\n[ 1203.521469] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000000000000010b\n[ 1203.522583] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8df18b07\n[ 1203.523550] R10: fffffbfff1be3160 R11: 0000000000000001 R12: 0000000000478399\n[ 1203.524596] R13: 0000000000000000 R14: ffff888145088000 R15: 0000000000000008\n[ 1203.525634] FS:  00007f429f5f4700(0000) GS:ffff8881daf00000(0000) knlGS:0000000000000000\n[ 1203.526801] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1203.527626] CR2: 000000000000010b CR3: 0000000170e1e001 CR4: 00000000003706e0\n[ 1203.528611] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 1203.529605] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n\nTherefore, when ftrace_startup_enable fails, we need to rollback registration\nprocess and remove ops from ftrace_ops_list."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through local ftrace registration paths (tracefs function tracer/instances/set_ftrace_filter probes, or perf_event_open function tracing) that call register_ftrace_function \u2192 ftrace_startup; there is no network or adjacent-protocol entry point.\nAC:L - An attacker who can drive ftrace registration fully controls creating dynamic ops, forcing the ftrace_startup_enable failure/disable window (as syzkaller did), ignoring failed unregister, and freeing the ops, then triggering is_ftrace_trampoline via stack unwind; success is not left to uncontrolled third-party state.\nPR:L - Worst reasonable deployments grant TRACE_MODE_WRITE (0640) via tracefs gid=tracing (Android atrace/perfetto, ChromeOS) or CAP_PERFMON for function tracing; these are delegatable low privileges, not init-namespace root, and are not obtainable only via full CAP_SYS_ADMIN.\nUI:N - The attacker creates instances/enables the function tracer (or opens a perf ftrace event), triggers the dead-ftrace register/unregister/free sequence, and causes stack unwinding themselves with no separate victim action.\nS:U - The dangling ftrace_ops UAF and any resulting memory corruption or oops remain inside the host kernel\u0027s privilege domain; this is not a VM escape, IOMMU bypass, or other cross-authority boundary crossing.\nC:H - Dynamically allocated ftrace_ops remain linked on ftrace_ops_list after free, so is_ftrace_trampoline\u0027s list walk is a use-after-free that can be reclaimed/sprayed to disclose kernel memory through trampoline/next field reads.\nI:H - The same UAF of struct ftrace_ops (including func/trampoline pointers) is heap-sprayable into type confusion and control-flow hijack when list walkers consume the reclaimed object, matching CVSS guidance that exploitable UAFs are Integrity High.\nA:H - The confirmed syzkaller outcome is a kernel NULL pointer dereference oops in is_ftrace_trampoline while walking the stale ops list, which panics or takes down the system and can be re-triggered after the dangling entry is left behind."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:56:59.013Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8569b4ada1e0b9bfaa125bd0c0967918b6560fa2"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c34a2a6c9927c239dd2e295a03d49b37b618d2c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ddffe882d74ef43a3494f0ab0c24baf076c45f96"
        },
        {
          "url": "https://git.kernel.org/stable/c/934e49f7d696afdae9f979abe3f308408184e17b"
        },
        {
          "url": "https://git.kernel.org/stable/c/dbd8c8fc60480e3faa3ae7e27ebe03371ecd1b77"
        },
        {
          "url": "https://git.kernel.org/stable/c/e4ae97295984ff1b9b340ed18ae1b066f36b7835"
        },
        {
          "url": "https://git.kernel.org/stable/c/d81bd6671f45fde4c3ac7fd7733c6e3082ae9d8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3b0f72e805f0801f05fa2aa52011c4bfc694c44"
        }
      ],
      "title": "ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49977",
    "datePublished": "2025-06-18T11:00:39.871Z",
    "dateReserved": "2025-06-18T10:57:27.385Z",
    "dateUpdated": "2026-08-05T08:56:59.013Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49977",
      "date": "2026-09-19",
      "epss": "0.00259",
      "percentile": "0.17933"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/trace/ftrace.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "8569b4ada1e0b9bfaa125bd0c0967918b6560fa2",
                    "status": "affected",
                    "version": "8a56d7761d2d041ae5e8215d20b4167d8aa93f51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4c34a2a6c9927c239dd2e295a03d49b37b618d2c",
                    "status": "affected",
                    "version": "8a56d7761d2d041ae5e8215d20b4167d8aa93f51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ddffe882d74ef43a3494f0ab0c24baf076c45f96",
                    "status": "affected",
                    "version": "8a56d7761d2d041ae5e8215d20b4167d8aa93f51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "934e49f7d696afdae9f979abe3f308408184e17b",
                    "status": "affected",
                    "version": "8a56d7761d2d041ae5e8215d20b4167d8aa93f51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dbd8c8fc60480e3faa3ae7e27ebe03371ecd1b77",
                    "status": "affected",
                    "version": "8a56d7761d2d041ae5e8215d20b4167d8aa93f51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e4ae97295984ff1b9b340ed18ae1b066f36b7835",
                    "status": "affected",
                    "version": "8a56d7761d2d041ae5e8215d20b4167d8aa93f51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d81bd6671f45fde4c3ac7fd7733c6e3082ae9d8e",
                    "status": "affected",
                    "version": "8a56d7761d2d041ae5e8215d20b4167d8aa93f51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c3b0f72e805f0801f05fa2aa52011c4bfc694c44",
                    "status": "affected",
                    "version": "8a56d7761d2d041ae5e8215d20b4167d8aa93f51",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "969a08e9048ddd0d655a19e692673cdb95116ce6",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "51d351d5b949ae7204696ada7ef502ed34d34fb0",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "2940c25bec92f40a3f7f32504b8ea115d1701892",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "189f4e672fc1c086f78818affc810ef29dda42a3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3.3",
                    "status": "affected",
                    "version": "3.2.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.5",
                    "status": "affected",
                    "version": "3.4.72",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.11",
                    "status": "affected",
                    "version": "3.10.22",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "3.13",
                    "status": "affected",
                    "version": "3.12.3",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "kernel/trace/ftrace.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.13"
                  },
                  {
                    "lessThan": "3.13",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.9.*",
                    "status": "unaffected",
                    "version": "4.9.327",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.14.*",
                    "status": "unaffected",
                    "version": "4.14.292",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.257",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.141",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.65",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.19.*",
                    "status": "unaffected",
                    "version": "5.19.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3433BB10-41AC-4CF0-B19A-0EC09FF26272",
                    "versionEndExcluding": "4.9.327",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "42DF7D19-F259-47AF-8715-288480443B27",
                    "versionEndExcluding": "4.14.292",
                    "versionStartIncluding": "4.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "379F570B-8101-4252-AE1C-B802D441D9B4",
                    "versionEndExcluding": "4.19.257",
                    "versionStartIncluding": "4.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BEFFBCD7-9B53-46AB-B3FD-53EAD80FD3E1",
                    "versionEndExcluding": "5.4.212",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6872143E-BF6D-4DB5-8454-D843F608AB3B",
                    "versionEndExcluding": "5.10.141",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "81162A58-341F-455C-96D5-6DF30A0F9295",
                    "versionEndExcluding": "5.15.65",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DEBCC9D9-2058-44E1-8A2E-ABC880E4DE50",
                    "versionEndExcluding": "5.19.7",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "E8BD11A3-8643-49B6-BADE-5029A0117325",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead\n\nftrace_startup does not remove ops from ftrace_ops_list when\nftrace_startup_enable fails:\n\nregister_ftrace_function\n  ftrace_startup\n    __register_ftrace_function\n      ...\n      add_ftrace_ops(\u0026ftrace_ops_list, ops)\n      ...\n    ...\n    ftrace_startup_enable // if ftrace failed to modify, ftrace_disabled is set to 1\n    ...\n  return 0 // ops is in the ftrace_ops_list.\n\nWhen ftrace_disabled = 1, unregister_ftrace_function simply returns without doing anything:\nunregister_ftrace_function\n  ftrace_shutdown\n    if (unlikely(ftrace_disabled))\n            return -ENODEV;  // return here, __unregister_ftrace_function is not executed,\n                             // as a result, ops is still in the ftrace_ops_list\n    __unregister_ftrace_function\n    ...\n\nIf ops is dynamically allocated, it will be free later, in this case,\nis_ftrace_trampoline accesses NULL pointer:\n\nis_ftrace_trampoline\n  ftrace_ops_trampoline\n    do_for_each_ftrace_op(op, ftrace_ops_list) // OOPS! op may be NULL!\n\nSyzkaller reports as follows:\n[ 1203.506103] BUG: kernel NULL pointer dereference, address: 000000000000010b\n[ 1203.508039] #PF: supervisor read access in kernel mode\n[ 1203.508798] #PF: error_code(0x0000) - not-present page\n[ 1203.509558] PGD 800000011660b067 P4D 800000011660b067 PUD 130fb8067 PMD 0\n[ 1203.510560] Oops: 0000 [#1] SMP KASAN PTI\n[ 1203.511189] CPU: 6 PID: 29532 Comm: syz-executor.2 Tainted: G    B   W         5.10.0 #8\n[ 1203.512324] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n[ 1203.513895] RIP: 0010:is_ftrace_trampoline+0x26/0xb0\n[ 1203.514644] Code: ff eb d3 90 41 55 41 54 49 89 fc 55 53 e8 f2 00 fd ff 48 8b 1d 3b 35 5d 03 e8 e6 00 fd ff 48 8d bb 90 00 00 00 e8 2a 81 26 00 \u003c48\u003e 8b ab 90 00 00 00 48 85 ed 74 1d e8 c9 00 fd ff 48 8d bb 98 00\n[ 1203.518838] RSP: 0018:ffffc900012cf960 EFLAGS: 00010246\n[ 1203.520092] RAX: 0000000000000000 RBX: 000000000000007b RCX: ffffffff8a331866\n[ 1203.521469] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000000000000010b\n[ 1203.522583] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8df18b07\n[ 1203.523550] R10: fffffbfff1be3160 R11: 0000000000000001 R12: 0000000000478399\n[ 1203.524596] R13: 0000000000000000 R14: ffff888145088000 R15: 0000000000000008\n[ 1203.525634] FS:  00007f429f5f4700(0000) GS:ffff8881daf00000(0000) knlGS:0000000000000000\n[ 1203.526801] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1203.527626] CR2: 000000000000010b CR3: 0000000170e1e001 CR4: 00000000003706e0\n[ 1203.528611] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 1203.529605] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n\nTherefore, when ftrace_startup_enable fails, we need to rollback registration\nprocess and remove ops from ftrace_ops_list."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ftrace: Se corrige la desreferencia del puntero NULL en is_ftrace_trampoline cuando ftrace est\u00e1 inactivo ftrace_startup no elimina las operaciones de ftrace_ops_list cuando ftrace_startup_enable falla: register_ftrace_function ftrace_startup __register_ftrace_function ... add_ftrace_ops(\u0026amp;ftrace_ops_list, ops) ... ... ftrace_startup_enable // si ftrace no se modific\u00f3, ftrace_disabled se establece en 1 ... return 0 // las operaciones est\u00e1n en ftrace_ops_list. Cuando ftrace_disabled = 1, unregister_ftrace_function simplemente regresa sin hacer nada: unregister_ftrace_function ftrace_shutdown if (unlikely(ftrace_disabled)) return -ENODEV; // regresa aqu\u00ed, __unregister_ftrace_function no se ejecuta, // como resultado, ops todav\u00eda est\u00e1 en ftrace_ops_list __unregister_ftrace_function ... Si ops se asigna din\u00e1micamente, estar\u00e1 libre m\u00e1s tarde, en este caso, is_ftrace_trampoline accede al puntero NULL: is_ftrace_trampoline ftrace_ops_trampoline do_for_each_ftrace_op(op, ftrace_ops_list) // \u00a1UPS! \u00a1op puede ser NULL! Syzkaller informa lo siguiente: [ 1203.506103] ERROR: desreferencia de puntero NULL del kernel, direcci\u00f3n: 000000000000010b [ 1203.508039] #PF: acceso de lectura del supervisor en modo kernel [ 1203.508798] #PF: error_code(0x0000) - p\u00e1gina no presente [ 1203.509558] PGD 800000011660b067 P4D 800000011660b067 PUD 130fb8067 PMD 0 [ 1203.510560] Oops: 0000 [#1] SMP KASAN PTI [ 1203.511189] CPU: 6 PID: 29532 Comm: syz-executor.2 Contaminado: GBW 5.10.0 #8 [1203.512324] Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 01/04/2014 [1203.513895] RIP: 0010:is_ftrace_trampoline+0x26/0xb0 [1203.514644] C\u00f3digo: ff eb d3 90 41 55 41 54 49 89 fc 55 53 e8 f2 00 fd ff 48 8b 1d 3b 35 5d 03 e8 e6 00 fd ff 48 8d bb 90 00 00 00 e8 2a 81 26 00 \u0026lt;48\u0026gt; 8b ab 90 00 00 00 48 85 ed 74 1d e8 c9 00 fd ff 48 8d bb 98 00 [ 1203.518838] RSP: 0018:ffffc900012cf960 EFLAGS: 00010246 [ 1203.520092] RAX: 000000000000000 RBX: 000000000000007b RCX: ffffffff8a331866 [ 1203.521469] RDX: 00000000000000000 RSI: 0000000000000008 RDI: 0000000000000010b [ 1203.522583] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8df18b07 [ 1203.523550] R10: fffffbfff1be3160 R11: 000000000000001 R12: 0000000000478399 [ 1203.524596] R13: 000000000000000 R14: ffff888145088000 R15: 0000000000000008 [ 1203.525634] FS: 00007f429f5f4700(0000) GS:ffff8881daf00000(0000) knlGS:0000000000000000 [ 1203.526801] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1203.527626] CR2: 00000000000010b CR3: 0000000170e1e001 CR4: 000000000003706e0 [ 1203.528611] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1203.529605] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Por lo tanto, cuando ftrace_startup_enable falla, debemos revertir el proceso de registro y eliminar las operaciones de ftrace_ops_list."
          }
        ],
        "id": "CVE-2022-49977",
        "lastModified": "2026-08-04T10:18:01.660",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-06-18T11:15:25.120",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4c34a2a6c9927c239dd2e295a03d49b37b618d2c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8569b4ada1e0b9bfaa125bd0c0967918b6560fa2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/934e49f7d696afdae9f979abe3f308408184e17b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c3b0f72e805f0801f05fa2aa52011c4bfc694c44"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d81bd6671f45fde4c3ac7fd7733c6e3082ae9d8e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/dbd8c8fc60480e3faa3ae7e27ebe03371ecd1b77"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ddffe882d74ef43a3494f0ab0c24baf076c45f96"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e4ae97295984ff1b9b340ed18ae1b066f36b7835"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-476"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:42:44+00:00",
      "cve": "CVE-2022-49977",
      "id": "CVE-2022-49977",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "1087",
      "product_status:known_affected": "36",
      "product_status:known_not_affected": "104",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49977.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T01:25:43Z",
      "cve": "CVE-2022-49977",
      "id": "CVE-2022-49977",
      "initial_release_date": "2025-06-19T03:45:03Z",
      "product_status:known_affected": "491",
      "product_status:known_not_affected": "196",
      "product_status:recommended": "359",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49977",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49977.json",
      "version": "58"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.