ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead
In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead ftrace_startup does not remove ops from ftrace_ops_list when ftrace_startup_enable fails: register_ftrace_function ftrace_startup __register_ftrace_function ... add_ftrace_ops(&ftrace_ops_list, ops) ... ... ftrace_startup_enable // if ftrace failed to modify, ftrace_disabled is set to 1 ... return 0 // ops is in the ftrace_ops_list. When ftrace_disabled = 1, unregister_ftrace_function simply returns without doing anything: unregister_ftrace_function ftrace_shutdown if (unlikely(ftrace_disabled)) return -ENODEV; // return here, __unregister_ftrace_function is not executed, // as a result, ops is still in the ftrace_ops_list __unregister_ftrace_function ... If ops is dynamically allocated, it will be free later, in this case, is_ftrace_trampoline accesses NULL pointer: is_ftrace_trampoline ftrace_ops_trampoline do_for_each_ftrace_op(op, ftrace_ops_list) // OOPS! op may be NULL! Syzkaller reports as follows: [ 1203.506103] BUG: kernel NULL pointer dereference, address: 000000000000010b [ 1203.508039] #PF: supervisor read access in kernel mode [ 1203.508798] #PF: error_code(0x0000) - not-present page [ 1203.509558] PGD 800000011660b067 P4D 800000011660b067 PUD 130fb8067 PMD 0 [ 1203.510560] Oops: 0000 [#1] SMP KASAN PTI [ 1203.511189] CPU: 6 PID: 29532 Comm: syz-executor.2 Tainted: G B W 5.10.0 #8 [ 1203.512324] Hardware name: QEMU S
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 4.14.292, 4.19.257, 4.9.327, 5.10.141, 5.15.65, 5.19.7, 5.4.212
- CVEs
- CVE-2022-49977
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 13:27 UTC · Revision 1
Source evidence
ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead
core-osv · Original sourcePublished 18 Jun 2025, 11:00 UTC
In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead ftrace_startup does not remove ops from ftrace_ops_list when ftrace_startup_enable fails: register_ftrace_function ftrace_startup __register_ftrace_function ... add_ftrace_ops(&ftrace_ops_list, ops) ... ... ftrace_startup_enable // if ftrace failed to modify, ftrace_disabled is set to 1 ... return 0 // ops is in the ftrace_ops_list. When ftrace_disabled = 1, unregister_ftrace_function simply returns without doing anything: unregister_ftrace_function ftrace_shutdown if (unlikely(ftrace_disabled)) return -ENODEV; // return here, __unregister_ftrace_function is not executed, // as a result, ops is still in the ftrace_ops_list __unregister_ftrace_function ... If ops is dynamically allocated, it will be free later, in this case, is_ftrace_trampoline accesses NULL pointer: is_ftrace_trampoline ftrace_ops_trampoline do_for_each_ftrace_op(op, ftrace_ops_list) // OOPS! op may be NULL! Syzkaller reports as follows: [ 1203.506103] BUG: kernel NULL pointer dereference, address: 000000000000010b [ 1203.508039] #PF: supervisor read access in kernel mode [ 1203.508798] #PF: error_code(0x0000) - not-present page [ 1203.509558] PGD 800000011660b067 P4D 800000011660b067 PUD 130fb8067 PMD 0 [ 1203.510560] Oops: 0000 [#1] SMP KASAN PTI [ 1203.511189] CPU: 6 PID: 29532 Comm: syz-executor.2 Tainted: G B W 5.10.0 #8 [ 1203.512324] Hardware name: QEMU S
osv:CVE-2022-49977
Kernel
Fixed versions: 4.9.327, 4.14.292, 4.19.257, 5.4.212, 5.10.141, 5.15.65, 5.19.7
Complete source record
{
"id": "82d66973cec721c2ea347e5dabb6234c0a3c9278eae7aa2eb2679c79ba75ccfc",
"url": "https://osv.dev/vulnerability/CVE-2022-49977",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead",
"summary": "In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead ftrace_startup does not remove ops from ftrace_ops_list when ftrace_startup_enable fails: register_ftrace_function ftrace_startup __register_ftrace_function ... add_ftrace_ops(&ftrace_ops_list, ops) ... ... ftrace_startup_enable // if ftrace failed to modify, ftrace_disabled is set to 1 ... return 0 // ops is in the ftrace_ops_list. When ftrace_disabled = 1, unregister_ftrace_function simply returns without doing anything: unregister_ftrace_function ftrace_shutdown if (unlikely(ftrace_disabled)) return -ENODEV; // return here, __unregister_ftrace_function is not executed, // as a result, ops is still in the ftrace_ops_list __unregister_ftrace_function ... If ops is dynamically allocated, it will be free later, in this case, is_ftrace_trampoline accesses NULL pointer: is_ftrace_trampoline ftrace_ops_trampoline do_for_each_ftrace_op(op, ftrace_ops_list) // OOPS! op may be NULL! Syzkaller reports as follows: [ 1203.506103] BUG: kernel NULL pointer dereference, address: 000000000000010b [ 1203.508039] #PF: supervisor read access in kernel mode [ 1203.508798] #PF: error_code(0x0000) - not-present page [ 1203.509558] PGD 800000011660b067 P4D 800000011660b067 PUD 130fb8067 PMD 0 [ 1203.510560] Oops: 0000 [#1] SMP KASAN PTI [ 1203.511189] CPU: 6 PID: 29532 Comm: syz-executor.2 Tainted: G B W 5.10.0 #8 [ 1203.512324] Hardware name: QEMU S",
"evidence": "osv:CVE-2022-49977",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.9.327",
"evidence": "/affected/1/ranges"
},
{
"value": "4.14.292",
"evidence": "/affected/1/ranges"
},
{
"value": "4.19.257",
"evidence": "/affected/1/ranges"
},
{
"value": "5.4.212",
"evidence": "/affected/1/ranges"
},
{
"value": "5.10.141",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.65",
"evidence": "/affected/1/ranges"
},
{
"value": "5.19.7",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2022-49977",
"aliases": [
"CVE-2022-49977"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "8a56d7761d2d041ae5e8215d20b4167d8aa93f51"
},
{
"fixed": "8569b4ada1e0b9bfaa125bd0c0967918b6560fa2"
},
{
"fixed": "4c34a2a6c9927c239dd2e295a03d49b37b618d2c"
},
{
"fixed": "ddffe882d74ef43a3494f0ab0c24baf076c45f96"
},
{
"fixed": "934e49f7d696afdae9f979abe3f308408184e17b"
},
{
"fixed": "dbd8c8fc60480e3faa3ae7e27ebe03371ecd1b77"
},
{
"fixed": "e4ae97295984ff1b9b340ed18ae1b066f36b7835"
},
{
"fixed": "d81bd6671f45fde4c3ac7fd7733c6e3082ae9d8e"
},
{
"fixed": "c3b0f72e805f0801f05fa2aa52011c4bfc694c44"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "3.2.54"
},
{
"fixed": "3.3"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "3.4.72"
},
{
"fixed": "3.5"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "3.10.22"
},
{
"fixed": "3.11"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "3.12.3"
},
{
"fixed": "3.13"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "969a08e9048ddd0d655a19e692673cdb95116ce6"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "51d351d5b949ae7204696ada7ef502ed34d34fb0"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "2940c25bec92f40a3f7f32504b8ea115d1701892"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "189f4e672fc1c086f78818affc810ef29dda42a3"
}
]
}
],
"versions": [
"v3.2.102",
"v3.2.101",
"v3.2.100",
"v3.2.99",
"v3.2.98",
"v3.2.97",
"v3.2.96",
"v3.2.95",
"v3.2.94",
"v3.2.93",
"v3.2.92",
"v3.2.91",
"v3.2.90",
"v3.2.89",
"v3.2.88",
"v3.2.87",
"v3.2.86",
"v3.2.85",
"v3.2.84",
"v3.2.83",
"v3.2.82",
"v3.2.81",
"v3.2.80",
"v3.2.79",
"v3.2.78",
"v3.2.77",
"v3.2.76",
"v3.2.75",
"v3.2.74",
"v3.2.73",
"v3.2.72",
"v3.2.71",
"v3.2.70",
"v3.2.69",
"v3.2.68",
"v3.2.67",
"v3.2.66",
"v3.2.65",
"v3.2.64",
"v3.2.63",
"v3.2.62",
"v3.2.61",
"v3.2.60",
"v3.2.59",
"v3.2.58",
"v3.2.57",
"v3.2.56",
"v3.2.55",
"v3.2.54",
"v3.4.113",
"v3.4.112",
"v3.4.111",
"v3.4.110",
"v3.4.109",
"v3.4.108",
"v3.4.107",
"v3.4.106",
"v3.4.105",
"v3.4.104",
"v3.4.103",
"v3.4.102",
"v3.4.101",
"v3.4.100",
"v3.4.99",
"v3.4.98",
"v3.4.97",
"v3.4.96",
"v3.4.95",
"v3.4.94",
"v3.4.93",
"v3.4.92",
"v3.4.91",
"v3.4.90",
"v3.4.89",
"v3.4.88",
"v3.4.87",
"v3.4.86",
"v3.4.85",
"v3.4.84",
"v3.4.83",
"v3.4.82",
"v3.4.81",
"v3.4.80",
"v3.4.79",
"v3.4.78",
"v3.4.77",
"v3.4.76",
"v3.4.75",
"v3.4.74",
"v3.4.73",
"v3.4.72",
"v3.10.108",
"v3.10.107",
"v3.10.106",
"v3.10.105",
"v3.10.104",
"v3.10.103",
"v3.10.102",
"v3.10.101",
"v3.10.100",
"v3.10.99",
"v3.10.98",
"v3.10.97",
"v3.10.96",
"v3.10.95",
"v3.10.94",
"v3.10.93",
"v3.10.92",
"v3.10.91",
"v3.10.90",
"v3.10.89",
"v3.10.88",
"v3.10.87",
"v3.10.86",
"v3.10.85",
"v3.10.84",
"v3.10.83",
"v3.10.82",
"v3.10.81",
"v3.10.80",
"v3.10.79",
"v3.10.78",
"v3.10.77",
"v3.10.76",
"v3.10.75",
"v3.10.74",
"v3.10.73",
"v3.10.72",
"v3.10.71",
"v3.10.70",
"v3.10.69",
"v3.10.68",
"v3.10.67",
"v3.10.66",
"v3.10.65",
"v3.10.64",
"v3.10.63",
"v3.10.62",
"v3.10.61",
"v3.10.60",
"v3.10.59",
"v3.10.58",
"v3.10.57",
"v3.10.56",
"v3.10.55",
"v3.10.54",
"v3.10.53",
"v3.10.52",
"v3.10.51",
"v3.10.50",
"v3.10.49",
"v3.10.48",
"v3.10.47",
"v3.10.46",
"v3.10.45",
"v3.10.44",
"v3.10.43",
"v3.10.42",
"v3.10.41",
"v3.10.40",
"v3.10.39",
"v3.10.38",
"v3.10.37",
"v3.10.36",
"v3.10.35",
"v3.10.34",
"v3.10.33",
"v3.10.32",
"v3.10.31",
"v3.10.30",
"v3.10.29",
"v3.10.28",
"v3.10.27",
"v3.10.26",
"v3.10.25",
"v3.10.24",
"v3.10.23",
"v3.10.22",
"v3.12.74",
"v3.12.73",
"v3.12.72",
"v3.12.71",
"v3.12.70",
"v3.12.69",
"v3.12.68",
"v3.12.67",
"v3.12.66",
"v3.12.65",
"v3.12.64",
"v3.12.63",
"v3.12.62",
"v3.12.61",
"v3.12.60",
"v3.12.59",
"v3.12.58",
"v3.12.57",
"v3.12.56",
"v3.12.55",
"v3.12.54",
"v3.12.53",
"v3.12.52",
"v3.12.51",
"v3.12.50",
"v3.12.49",
"v3.12.48",
"v3.12.47",
"v3.12.46",
"v3.12.45",
"v3.12.44",
"v3.12.43",
"v3.12.42",
"v3.12.41",
"v3.12.40",
"v3.12.39",
"v3.12.38",
"v3.12.37",
"v3.12.36",
"v3.12.35",
"v3.12.34",
"v3.12.33",
"v3.12.32",
"v3.12.31",
"v3.12.30",
"v3.12.29",
"v3.12.28",
"v3.12.27",
"v3.12.26",
"v3.12.25",
"v3.12.24",
"v3.12.23",
"v3.12.22",
"v3.12.21",
"v3.12.20",
"v3.12.19",
"v3.12.18",
"v3.12.17",
"v3.12.16",
"v3.12.15",
"v3.12.14",
"v3.12.13",
"v3.12.12",
"v3.12.11",
"v3.12.10",
"v3.12.9",
"v3.12.8",
"v3.12.7",
"v3.12.6",
"v3.12.5",
"v3.12.4",
"v3.12.3"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49977.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.13.0"
},
{
"fixed": "4.9.327"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.10.0"
},
{
"fixed": "4.14.292"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.15.0"
},
{
"fixed": "4.19.257"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.20.0"
},
{
"fixed": "5.4.212"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.5.0"
},
{
"fixed": "5.10.141"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.65"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "5.19.7"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49977.json"
}
}
],
"modified": "2026-10-28T02:30:36.031240642Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/4c34a2a6c9927c239dd2e295a03d49b37b618d2c",
"https://git.kernel.org/stable/c/8569b4ada1e0b9bfaa125bd0c0967918b6560fa2",
"https://git.kernel.org/stable/c/934e49f7d696afdae9f979abe3f308408184e17b",
"https://git.kernel.org/stable/c/c3b0f72e805f0801f05fa2aa52011c4bfc694c44",
"https://git.kernel.org/stable/c/d81bd6671f45fde4c3ac7fd7733c6e3082ae9d8e",
"https://git.kernel.org/stable/c/dbd8c8fc60480e3faa3ae7e27ebe03371ecd1b77",
"https://git.kernel.org/stable/c/ddffe882d74ef43a3494f0ab0c24baf076c45f96",
"https://git.kernel.org/stable/c/e4ae97295984ff1b9b340ed18ae1b066f36b7835",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49977.json",
"https://nvd.nist.gov/vuln/detail/CVE-2022-49977",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49977.json"
}
},
"related_cves": [
{
"value": "CVE-2022-49977",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 503111,
"published_at": "2025-06-18T11:00:39.871+00:00"
}