CVE-2022-49977: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49977 is a NULL pointer dereference vulnerability in the Linux kernel's ftrace (function tracer) subsystem. The flaw was published on June 18, 2025, and affects multiple Linux kernel versions: all versions before 4.9.327, 4.10–4.13.x before 4.14.292, 4.14–4.18.x before 4.19.257, 4.19–5.3.x before 5.4.212, 5.5–5.9.x before 5.10.141, 5.11–5.14.x before 5.15.65, 5.16–5.18.x before 5.19.7, and the 6.0-rc1 pre-release. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a NULL pointer dereference (CWE-476) in the is_ftrace_trampoline function within the Linux kernel's ftrace subsystem. When ftrace_startup_enable fails (setting ftrace_disabled = 1), ftrace_startup does not remove the ops structure from ftrace_ops_list. Subsequently, unregister_ftrace_function returns early due to the disabled state without calling __unregister_ftrace_function, leaving a dangling ops pointer in the list. If the ops structure was dynamically allocated and later freed, is_ftrace_trampoline iterates over ftrace_ops_list via do_for_each_ftrace_op and dereferences the now-NULL pointer, triggering a kernel panic. The attack vector is local and requires low privileges (Feedly).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a kernel panic and system crash — a complete denial of service. There is no confidentiality or integrity impact; the vulnerability is limited to availability. The affected scope is the local system running a vulnerable Linux kernel version, with no lateral movement potential directly from this flaw (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. Exploitation requires local low-privileged access, which further limits the attack surface (Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing BUG: kernel NULL pointer dereference, address: 000000000000010b or similar messages referencing is_ftrace_trampoline or ftrace_ops_trampoline.
• Logs: Kernel oops or panic traces involving do_for_each_ftrace_op in the call stack.
• System Behavior: Unexpected system reboots or kernel panics on systems where ftrace is actively used and ftrace_disabled has been set due to a prior ftrace startup failure.

Apply the patched Linux kernel versions released for each affected branch: 4.9.327, 4.14.292, 4.19.257, 5.4.212, 5.10.141, 5.15.65, and 5.19.7. Patches are available from the official Linux kernel stable repositories (Kernel Patches). Distribution-specific updates have been issued by Red Hat (RHSA-2025:11850, RHSA-2025:14511, RHSA-2025:14691, RHSA-2025:14742, RHSA-2025:14744, RHSA-2025:14749, RHSA-2025:15035), SUSE, openSUSE, AlmaLinux (ALSA-2025-11850), and Oracle Linux (Red Hat Errata, AlmaLinux Errata). As a workaround, restricting local user access to minimize the risk of triggering the vulnerable code path is advisable until patching is complete.