CVE-2022-49254: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49254 affects the Linux kernel's media subsystem, specifically in the TI-VPE (Texas Instruments Video Processing Engine) driver. The vulnerability was discovered through static analysis and involves a potential NULL pointer dereference in the cal_ctx_v4l2_init_formats() function. The issue was publicly disclosed and fixed in February 2025 (NVD).

The vulnerability exists in the cal_ctx_v4l2_init_formats() function where devm_kzalloc() is assigned to ctx->active_fmt followed by a dereference without proper NULL checking. This could lead to a NULL pointer dereference if devm_kzalloc() fails. The issue was introduced in commit 7168155002cf which moved format handling to cal.c (Kernel Commit).

If exploited, this vulnerability could lead to a NULL pointer dereference in the Linux kernel's media subsystem, potentially causing a system crash or denial of service condition (NVD).

The vulnerability requires access to a system running the affected Linux kernel version with the TI-VPE driver. The issue is triggered through normal operation of the video subsystem and does not require special privileges beyond those needed to interact with the video device (NVD).

The vulnerability has been fixed by adding a NULL check of ctx->active_fmt before dereferencing. The fix was implemented and committed to the Linux kernel. Users should update their kernel to a version containing the fix (Kernel Commit).