CVE-2022-49940: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49940 is a vulnerability discovered in the Linux kernel's TTY subsystem, specifically in the GSM line discipline implementation. The vulnerability was disclosed on June 18, 2025, affecting the Linux kernel's n_gsm module. The issue involves a null pointer dereference vulnerability in the gsm_receive_buf() function (NVD).

The vulnerability stems from a null pointer dereference that occurs when attempting to access the gsm->receive() function in gsmld_receive_buf(). The code assumes that gsm->receive is only called after MUX activation. However, since the gsmld_receive_buf() function can be accessed without initializing the MUX, the gsm->receive() function will not be set, leading to a NULL pointer dereference (NVD).

The vulnerability could result in a system crash due to the null pointer dereference, potentially affecting system stability and availability. The issue occurs in the kernel's TTY subsystem, which could impact terminal and serial communication functionality (Wiz).

The vulnerability has been resolved by adding a sanity check to avoid calling gsm->receive() when the function is not initialized. This fix prevents the null pointer dereference by validating the function pointer before use (NVD).