CVE-2022-49187: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49187 is a vulnerability in the Linux kernel that was discovered in the clock (clk) subsystem. The issue was identified and resolved in the clkhwget_clk() function when handling NULL device pointers. The vulnerability was publicly disclosed and fixed on February 26, 2025 (NVD).

The vulnerability exists in the clkhwgetclk() function of the Linux kernel's clock subsystem. The issue occurs when handling clkcore structures with NULL device pointers, which while not documented, was a common practice evidenced by widespread usage of clkregister and clkhwregister with NULL device pointers. The function would attempt to call devname() on a NULL device pointer, resulting in a potential NULL pointer dereference. The vulnerability has been assigned a CVSS v3.1 score of 5.5 (MEDIUM) (NVD, Kernel Git).

The vulnerability could lead to a NULL pointer dereference in the Linux kernel's clock subsystem when calling clkhwgetclk() on a clkhw structure with a NULL device pointer, potentially causing system instability or crashes (Kernel Git).

The issue has been fixed by adding a check for NULL device pointers and using NULL as the dev_id in such cases. The fix was implemented in the Linux kernel through commit 0c1b56df451716ba207bbf59f303473643eee4fd (Kernel Git).