CVE-2022-49796: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49796 is a vulnerability discovered in the Linux kernel's tracing subsystem, specifically affecting the kprobe functionality. The vulnerability was disclosed on May 1, 2025, and involves a potential null pointer dereference in the kprobe_event_gen_test_exit() function (NVD).

The vulnerability occurs when test_gen_kprobe_cmd() fails after kprobe_event_gen_cmd_end(), triggering a goto delete operation that calls kprobe_event_delete() and releases the corresponding resource. The issue arises because the trace_array in gen_kretprobe_test continues to point to the invalid resource, potentially leading to a null pointer dereference. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5, indicating moderate severity (Red Hat, Wiz).

The vulnerability can result in a kernel NULL pointer dereference at address 0x70, which may lead to system crashes or denial of service conditions. This is particularly evident in the bug trace showing the crash in the _ftrace_set_clr_event_nolock function (NVD).

The fix involves setting gen_kretprobe_test to NULL after calling kprobe_event_delete() to prevent the null pointer dereference. Red Hat Enterprise Linux 9 has deferred the fix for both kernel and kernel-rt packages (Red Hat).