Skip to content
Heist/ feed
Back to feed
UnratedFix available

iommu/mediatek: Fix NULL pointer dereference when printing dev_name

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: Fix NULL pointer dereference when printing dev_name When larbdev is NULL (in the case I hit, the node is incorrectly set iommus = <&iommu NUM>), it will cause device_link_add() fail and kernel crashes when we try to print dev_name(larbdev). Let's fail the probe if a larbdev is NULL to avoid invalid inputs from dts. It should work for normal correct setting and avoid the crash caused by my incorrect setting. Error log: [ 18.189042][ T301] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050 ... [ 18.344519][ T301] pstate: a0400005 (NzCv daif +PAN -UAO) [ 18.345213][ T301] pc : mtk_iommu_probe_device+0xf8/0x118 [mtk_iommu] [ 18.346050][ T301] lr : mtk_iommu_probe_device+0xd0/0x118 [mtk_iommu] [ 18.346884][ T301] sp : ffffffc00a5635e0 [ 18.347392][ T301] x29: ffffffc00a5635e0 x28: ffffffd44a46c1d8 [ 18.348156][ T301] x27: ffffff80c39a8000 x26: ffffffd44a80cc38 [ 18.348917][ T301] x25: 0000000000000000 x24: ffffffd44a80cc38 [ 18.349677][ T301] x23: ffffffd44e4da4c6 x22: ffffffd44a80cc38 [ 18.350438][ T301] x21: ffffff80cecd1880 x20: 0000000000000000 [ 18.351198][ T301] x19: ffffff80c439f010 x18: ffffffc00a50d0c0 [ 18.351959][ T301] x17: ffffffffffffffff x16: 0000000000000004 [ 18.352719][ T301] x15: 0000000000000004 x14: ffffffd44eb5d420 [ 18.353480][ T301] x13: 0000000000000ad2 x12: 0000000000000003 [ 18.354241][ T301] x11: 00000000fffffad2 x10: c0000000fffffad2 [

Products
Kernel
Affected versions
Not specified
Fixed versions
5.15.46, 5.17.14, 5.18.3
CVEs
CVE-2022-49424
Confirmed fixed CVEs
Not specified
Updated in this feed
5 Nov 2026, 05:31 UTC · Revision 1

Source evidence

iommu/mediatek: Fix NULL pointer dereference when printing dev_name

core-osv · Original source

Published 26 Feb 2025, 02:12 UTC

In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: Fix NULL pointer dereference when printing dev_name When larbdev is NULL (in the case I hit, the node is incorrectly set iommus = <&iommu NUM>), it will cause device_link_add() fail and kernel crashes when we try to print dev_name(larbdev). Let's fail the probe if a larbdev is NULL to avoid invalid inputs from dts. It should work for normal correct setting and avoid the crash caused by my incorrect setting. Error log: [ 18.189042][ T301] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050 ... [ 18.344519][ T301] pstate: a0400005 (NzCv daif +PAN -UAO) [ 18.345213][ T301] pc : mtk_iommu_probe_device+0xf8/0x118 [mtk_iommu] [ 18.346050][ T301] lr : mtk_iommu_probe_device+0xd0/0x118 [mtk_iommu] [ 18.346884][ T301] sp : ffffffc00a5635e0 [ 18.347392][ T301] x29: ffffffc00a5635e0 x28: ffffffd44a46c1d8 [ 18.348156][ T301] x27: ffffff80c39a8000 x26: ffffffd44a80cc38 [ 18.348917][ T301] x25: 0000000000000000 x24: ffffffd44a80cc38 [ 18.349677][ T301] x23: ffffffd44e4da4c6 x22: ffffffd44a80cc38 [ 18.350438][ T301] x21: ffffff80cecd1880 x20: 0000000000000000 [ 18.351198][ T301] x19: ffffff80c439f010 x18: ffffffc00a50d0c0 [ 18.351959][ T301] x17: ffffffffffffffff x16: 0000000000000004 [ 18.352719][ T301] x15: 0000000000000004 x14: ffffffd44eb5d420 [ 18.353480][ T301] x13: 0000000000000ad2 x12: 0000000000000003 [ 18.354241][ T301] x11: 00000000fffffad2 x10: c0000000fffffad2 [

osv:CVE-2022-49424

Kernel

Fixed versions: 5.15.46, 5.17.14, 5.18.3

Complete source record
{
  "id": "5aaf33b98b195ee0ebcc4439b10412b7bb9fdf3739bc93bc895047f2f7376400",
  "url": "https://osv.dev/vulnerability/CVE-2022-49424",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "iommu/mediatek: Fix NULL pointer dereference when printing dev_name",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: Fix NULL pointer dereference when printing dev_name When larbdev is NULL (in the case I hit, the node is incorrectly set iommus = <&iommu NUM>), it will cause device_link_add() fail and kernel crashes when we try to print dev_name(larbdev). Let's fail the probe if a larbdev is NULL to avoid invalid inputs from dts. It should work for normal correct setting and avoid the crash caused by my incorrect setting. Error log: [ 18.189042][ T301] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050 ... [ 18.344519][ T301] pstate: a0400005 (NzCv daif +PAN -UAO) [ 18.345213][ T301] pc : mtk_iommu_probe_device+0xf8/0x118 [mtk_iommu] [ 18.346050][ T301] lr : mtk_iommu_probe_device+0xd0/0x118 [mtk_iommu] [ 18.346884][ T301] sp : ffffffc00a5635e0 [ 18.347392][ T301] x29: ffffffc00a5635e0 x28: ffffffd44a46c1d8 [ 18.348156][ T301] x27: ffffff80c39a8000 x26: ffffffd44a80cc38 [ 18.348917][ T301] x25: 0000000000000000 x24: ffffffd44a80cc38 [ 18.349677][ T301] x23: ffffffd44e4da4c6 x22: ffffffd44a80cc38 [ 18.350438][ T301] x21: ffffff80cecd1880 x20: 0000000000000000 [ 18.351198][ T301] x19: ffffff80c439f010 x18: ffffffc00a50d0c0 [ 18.351959][ T301] x17: ffffffffffffffff x16: 0000000000000004 [ 18.352719][ T301] x15: 0000000000000004 x14: ffffffd44eb5d420 [ 18.353480][ T301] x13: 0000000000000ad2 x12: 0000000000000003 [ 18.354241][ T301] x11: 00000000fffffad2 x10: c0000000fffffad2 [ ",
    "evidence": "osv:CVE-2022-49424",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.15.46",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.17.14",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.18.3",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2022-49424",
      "aliases": [
        "CVE-2022-49424"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "77fbe028d5a3f7fc6060c4454ead9510533acd1e"
                },
                {
                  "fixed": "c3c2734e28d7fac50228c4d2b8896e8695adf304"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "18ea450ed1b60c1bb336f5efe874f61909ce7bec"
                },
                {
                  "fixed": "e9c63c0f73a1bbfd02624f5eae7e881df8b6830f"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "635319a4a7444ca97124d781cd96deb277ff4d40"
                },
                {
                  "fixed": "8837c2682b9b2eed83e6212bcf79850c593a6fee"
                },
                {
                  "fixed": "de78657e16f41417da9332f09c2d67d100096939"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "5.15.33"
                },
                {
                  "fixed": "5.15.46"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "5.17.2"
                },
                {
                  "fixed": "5.17.14"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "5.16.19"
                },
                {
                  "fixed": "5.17"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "b7bf68272b6ae7c469854e2e054db1db1d158999"
                }
              ]
            }
          ],
          "versions": [
            "v5.15.45",
            "v5.15.44",
            "v5.15.43",
            "v5.15.42",
            "v5.15.41",
            "v5.15.40",
            "v5.15.39",
            "v5.15.38",
            "v5.15.37",
            "v5.15.36",
            "v5.15.35",
            "v5.15.34",
            "v5.15.33",
            "v5.17.13",
            "v5.17.12",
            "v5.17.11",
            "v5.17.10",
            "v5.17.9",
            "v5.17.8",
            "v5.17.7",
            "v5.17.6",
            "v5.17.5",
            "v5.17.4",
            "v5.17.3",
            "v5.17.2",
            "v5.16.20",
            "v5.16.19"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49424.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "5.15.46"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "5.17.14"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.18.0"
                },
                {
                  "fixed": "5.18.3"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49424.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:43.017693060Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/8837c2682b9b2eed83e6212bcf79850c593a6fee",
        "https://git.kernel.org/stable/c/c3c2734e28d7fac50228c4d2b8896e8695adf304",
        "https://git.kernel.org/stable/c/de78657e16f41417da9332f09c2d67d100096939",
        "https://git.kernel.org/stable/c/e9c63c0f73a1bbfd02624f5eae7e881df8b6830f",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49424.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2022-49424",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49424.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2022-49424",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 510731,
  "published_at": "2025-02-26T02:12:46.209+00:00"
}