CVE-2022-49187: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49187 is a vulnerability in the Linux kernel that was discovered in the clock (clk) subsystem. The issue was identified and resolved in the clk_hw_get_clk() function when handling NULL device pointers. The vulnerability was publicly disclosed and fixed on February 26, 2025 (NVD).

The vulnerability exists in the clk_hw_get_clk() function of the Linux kernel's clock subsystem. The issue occurs when handling clk_core structures with NULL device pointers, which while not documented, was a common practice evidenced by widespread usage of clk_register and clk_hw_register with NULL device pointers. The function would attempt to call dev_name() on a NULL device pointer, resulting in a potential NULL pointer dereference. The vulnerability has been assigned a CVSS v3.1 score of 5.5 (MEDIUM) (NVD, Kernel Git).

The vulnerability could lead to a NULL pointer dereference in the Linux kernel's clock subsystem when calling clk_hw_get_clk() on a clk_hw structure with a NULL device pointer, potentially causing system instability or crashes (Kernel Git).

The issue has been fixed by adding a check for NULL device pointers and using NULL as the dev_id in such cases. The fix was implemented in the Linux kernel through commit 0c1b56df451716ba207bbf59f303473643eee4fd (Kernel Git).