CVE-2022-49688: Linux Kernel

Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: afs: Fix dynamic root getattr The recent patch to make afs_getattr consult the server didn't account for the pseudo-inodes employed by the dynamic root-type afs superblock not having a volume or a server to access, and thus an oops occurs if such a directory is stat'd. Fix this by checking to see if the vnode->volume pointer actually points anywhere before following it in afs_getattr(). This can be tested by stat'ing a directory in /afs. It may be sufficient just to do "ls /afs" and the oops looks something like: BUG: kernel NULL pointer dereference, address: 0000000000000020 ... RIP: 0010:afs_getattr+0x8b/0x14b ... Call Trace: <TASK> vfs_statx+0x79/0xf5 vfs_fstatat+0x49/0x62

Affected products

• Linux Linux Kernel: from 4.19.245, before 4.19.250 (fixed in 4.19.250); from 5.4.196, before 5.4.202 (fixed in 5.4.202); from 5.10.118, before 5.10.127 (fixed in 5.10.127); from 5.15.42, before 5.15.51 (fixed in 5.15.51); from 5.17.10, before 5.18 (fixed in 5.18); from 5.18.1, before 5.18.8 (fixed in 5.18.8); …

Published 2025-02-26. Last modified 2026-06-17.