CVE-2022-49329: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a NULL pointer dereference vulnerability was discovered in the vduse (vDPA Device in Userspace) component. The issue occurs when accessing the control device's msg_timeout attribute via sysfs, as the control device has no drvdata. This vulnerability was assigned CVE-2022-49329 and was discovered in February 2025 (NVD).

The vulnerability manifests as a NULL pointer dereference at address 0x00000000000000f8 when attempting to access the msg_timeout attribute through sysfs. The issue occurs in the msg_timeout_show function in drivers/vdpa/vdpa_user/vduse_dev.c. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability leads to a kernel NULL pointer dereference, which can cause a system crash or denial of service condition. The impact is limited to local attacks and requires local user privileges to exploit (NVD).

The vulnerability has been fixed by removing the unneeded attribute for the control device. The fix involves modifying the device creation process to use device_create_with_groups instead of device_create and removing the dev_groups assignment from the vduse_class initialization (Kernel Patch).