CVE-2022-48972: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-48972 is a vulnerability in the Linux kernel's mac802154 subsystem, discovered in late 2022. The issue occurs in the ieee802154ifadd() function where it allocates wpandev as netdev's private data but fails to initialize the list in struct wpandev. This vulnerability affects Linux kernel versions from 3.19 through 6.1.x (NVD).

The vulnerability stems from a missing INITLISTHEAD initialization in the ieee802154ifadd() function. When cfg802154netdevnotifiercall() attempts to manage the list during device register/unregister operations, it can lead to a null pointer dereference. The issue manifests as a kernel NULL pointer dereference at address 0x0000000000000008, occurring in the cfg802154netdevnotifiercall function. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can result in a kernel NULL pointer dereference, which could lead to a system crash or denial of service condition. This affects the system's stability and availability, particularly when working with IEEE 802.15.4 wireless devices (Kernel Patch).

The vulnerability has been fixed by adding INITLISTHEAD() initialization to properly initialize the list in struct wpan_dev. The fix has been implemented in the kernel patch that adds the initialization code before the setup of type-dependent data. Users should update their Linux kernel to a patched version that includes this fix (Kernel Patch).