CVE-2022-49947: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-49947 is a NULL pointer dereference vulnerability in the Linux kernel's Android binder inter-process communication (IPC) mechanism. The flaw was introduced by commit 44e602b4e52f ("binder_alloc: add missing mmap_lock calls when using the VMA") and affects Linux kernel versions 5.15.64–5.15.66, 5.19.6–5.19.8, and 6.0-rc3. It was published on June 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a NULL pointer dereference (CWE-476) in the binder allocator when alloc->vma_vm_mm has not been initialized. This occurs in two scenarios: (1) a binder_proc receives a transaction before calling mmap() to set up the binder_proc->alloc space, causing binder_alloc_new_buf_locked() to attempt to acquire the uninitialized mmap_lock; and (2) binder_alloc_print_pages() encounters the same uninitialized pointer when dumping the debugfs binder stats file. The crash manifests as a KASAN null-ptr-deref in the range [0x0000000000000128–0x000000000000012f] within __lock_acquire in kernel/locking/lockdep.c (Feedly, Kernel Patch 1).

Successful exploitation allows a low-privileged local attacker to trigger a kernel NULL pointer dereference, resulting in a system crash and denial of service. There is no impact on confidentiality or integrity — only availability is affected. The vulnerability is limited to the local system and does not provide a direct path for privilege escalation or lateral movement based on currently available information (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.017%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low-privileged local access, limiting the attack surface (Feedly).

Patches are available for all affected kernel version ranges: update to Linux kernel 5.15.66 or later (for the 5.15.x branch), 5.19.8 or later (for the 5.19.x branch), or a post-rc3 6.0 release. The fixes are available in the upstream stable kernel tree. As a general hardening measure, restrict local user access to binder interfaces and monitor for unexpected kernel panics or KASAN reports. Apply kernel updates from trusted distribution sources (Kernel Patch 1, Kernel Patch 2, Kernel Patch 3).