CVE-2022-49945: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability was discovered in the Linux kernel's gpio-fan driver component, identified as CVE-2022-49945. The issue was disclosed on June 18, 2025, affecting the hwmon subsystem. The vulnerability exists because the driver fails to validate cooling state values passed to gpiofansetcurstate() against the maximum cooling state stored in fandata->numspeeds (NVD).

The vulnerability occurs in the gpio-fan driver when the cooling state passed to gpiofansetcurstate() is not properly validated against fandata->numspeeds. Since this cooling state is subsequently used as an array index in setfanspeed(), it can result in an array out of bounds access. The issue manifests when the state of the thermal cooling device is set to arbitrary values (NVD, Wiz).

When exploited, this vulnerability can cause a kernel oops when unavailable memory is accessed, potentially leading to system instability or denial of service. The vulnerability can be triggered by setting the state of the thermal cooling device to arbitrary values, which could result in system crashes (Wiz).

The vulnerability has been fixed in various Linux kernel versions. Multiple Linux distributions have released patches to address this issue, including Debian which has fixed versions available in bullseye (5.10.237-1), bookworm (6.1.140-1), and trixie (6.12.31-1) releases (Wiz).