Vulnerability DatabaseCVE-2022-49499

CVE-2022-49499:
Linux Kernel vulnerability analysis and mitigation

Overview

CVE-2022-49499 is a vulnerability in the Linux kernel's DRM/MSM (Direct Rendering Manager for Qualcomm Snapdragon) component. The vulnerability was disclosed on February 26, 2025, and involves potential null pointer dereferences in situations where IOMMU is not present. Specifically, the issue affects systems using MSM8974 chipsets where the 'aspace' pointer can remain null without IOMMU (Kernel Git).

Technical details

The vulnerability stems from a failure to check if the 'aspace' pointer is set before using it in the DRM/MSM driver. This condition occurs specifically when IOMMU (Input-Output Memory Management Unit) is not present in the system. The issue was introduced in commit bc2112583a0b ("drm/msm/gpu: Track global faults per address-space") and was fixed by adding proper null pointer checks before accessing the 'aspace' member (Kernel Git).

Impact

When triggered, this vulnerability can lead to null pointer dereferences in the Linux kernel's DRM/MSM driver, potentially causing system crashes or denial of service conditions on affected systems, particularly those using MSM8974 chipsets without IOMMU (Kernel Git).

Mitigation and workarounds

The vulnerability has been fixed by adding proper null pointer checks before accessing the 'aspace' member. The fix was implemented in two kernel commits that modify the affected files (drivers/gpu/drm/msm/adreno/adrenogpu.c and drivers/gpu/drm/msm/msmgpu.c) to properly handle cases where 'aspace' is null (Kernel Git).