Bug 1249647 (CVE-2022-50244) - VUL-0: CVE-2022-50244: kernel: cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter()
Summary: VUL-0: CVE-2022-50244: kernel: cxl: fix possible null-ptr-deref in cxl_pci_in...
Status: NEW
Alias: CVE-2022-50244
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/472333/
Whiteboard: CVSSv3.1:SUSE:CVE-2022-50244:5.5:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2025-09-16 07:55 UTC by SMASH SMASH
Modified: 2025-11-18 14:15 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2025-09-16 07:55:11 UTC 
In the Linux kernel, the following vulnerability has been resolved:

cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter()

If device_register() fails in cxl_pci_afu|adapter(), the device
is not added, device_unregister() can not be called in the error
path, otherwise it will cause a null-ptr-deref because of removing
not added device.

As comment of device_register() says, it should use put_device() to give
up the reference in the error path. So split device_unregister() into
device_del() and put_device(), then goes to put dev when register fails.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-50244
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2022/CVE-2022-50244.mbox
https://git.kernel.org/stable/c/82e68432668ae75b4c814d160f6987ecb0681273
https://git.kernel.org/stable/c/82e5481428faf11c79b9c094dd24a1849bbf64ac
https://git.kernel.org/stable/c/c4b2e35df919d99bbbed033c2fa0b607f9f463b5
https://git.kernel.org/stable/c/361412dae1690d4b5df6f92fc943cdc773c95cbc
https://git.kernel.org/stable/c/0f63c0ddc2ea20d783d29243f4dbe0f9e95dfdec
https://git.kernel.org/stable/c/22511eefa61db26e12c97dd7ada3071dbdfcb004
https://git.kernel.org/stable/c/139abd4c626a6f7ce02789ed5f73aa2256e0542b
https://git.kernel.org/stable/c/2f5fd31b2f24b9b8a80ab566fd8c4e1e94cb4339
https://git.kernel.org/stable/c/02cd3032b154fa02fdf90e7467abaeed889330b2
https://www.cve.org/CVERecord?id=CVE-2022-50244
https://bugzilla.redhat.com/show_bug.cgi?id=2395359
Comment 2 Takashi Iwai 2025-09-18 08:10:42 UTC 
Backported to SLE12-SP5 branch.
Comment 5 Maintenance Automation 2025-10-16 08:30:59 UTC 
SUSE-SU-2025:03614-1: An update that solves 183 vulnerabilities and has 25 security fixes can now be installed.

URL: https://www.suse.com/support/update/announcement/2025/suse-su-202503614-1
Category: security (important)
Bug References: 1065729, 1082555, 1164051, 1190317, 1203332, 1205128, 1206883, 1206884, 1207629, 1209287, 1209291, 1210124, 1210584, 1211960, 1213015, 1213016, 1213040, 1213041, 1213133, 1213666, 1213747, 1214953, 1214967, 1216976, 1235459, 1238467, 1241353, 1245196, 1246968, 1247118, 1247239, 1247483, 1248199, 1248255, 1248333, 1248341, 1248365, 1248399, 1248610, 1248617, 1248648, 1248669, 1248674, 1248847, 1249037, 1249164, 1249166, 1249186, 1249194, 1249200, 1249220, 1249254, 1249258, 1249266, 1249288, 1249295, 1249300, 1249334, 1249346, 1249374, 1249413, 1249504, 1249513, 1249515, 1249524, 1249526, 1249538, 1249545, 1249598, 1249604, 1249615, 1249641, 1249647, 1249658, 1249667, 1249683, 1249687, 1249696, 1249700, 1249706, 1249715, 1249716, 1249720, 1249725, 1249727, 1249734, 1249739, 1249740, 1249743, 1249744, 1249779, 1249798, 1249799, 1249802, 1249803, 1249808, 1249810, 1249827, 1249842, 1249846, 1249853, 1249865, 1249867, 1249871, 1249872, 1249877, 1249880, 1249882, 1249894, 1249908, 1249911, 1249912, 1249917, 1249918, 1249920, 1249922, 1249925, 1249927, 1249936, 1249938, 1249944, 1249947, 1249949, 1249950, 1249951, 1249958, 1249979, 1249981, 1249988, 1249991, 1249994, 1250007, 1250014, 1250018, 1250023, 1250024, 1250028, 1250043, 1250044, 1250045, 1250049, 1250052, 1250055, 1250058, 1250071, 1250072, 1250081, 1250084, 1250088, 1250104, 1250114, 1250121, 1250125, 1250127, 1250131, 1250132, 1250140, 1250145, 1250150, 1250155, 1250156, 1250165, 1250168, 1250177, 1250180, 1250183, 1250187, 1250198, 1250247, 1250250, 1250257, 1250269, 1250275, 1250281, 1250292, 1250294, 1250301, 1250313, 1250323, 1250324, 1250328, 1250358, 1250363, 1250365, 1250391, 1250392, 1250393, 1250394, 1250395, 1250397, 1250406, 1250407, 1250522, 1250765, 1250774, 1250792, 1250799, 1250818, 1250831, 1250851, 1250853, 1250856, 1250879, 1250915, 1250928, 1250949, 1250963, 1250965
CVE References: CVE-2022-36280, CVE-2022-43945, CVE-2022-49975, CVE-2022-50233, CVE-2022-50235, CVE-2022-50242, CVE-2022-50244, CVE-2022-50252, CVE-2022-50253, CVE-2022-50257, CVE-2022-50258, CVE-2022-50265, CVE-2022-50266, CVE-2022-50271, CVE-2022-50272, CVE-2022-50278, CVE-2022-50282, CVE-2022-50285, CVE-2022-50288, CVE-2022-50289, CVE-2022-50291, CVE-2022-50294, CVE-2022-50297, CVE-2022-50299, CVE-2022-50304, CVE-2022-50311, CVE-2022-50312, CVE-2022-50321, CVE-2022-50330, CVE-2022-50344, CVE-2022-50346, CVE-2022-50349, CVE-2022-50351, CVE-2022-50352, CVE-2022-50359, CVE-2022-50365, CVE-2022-50372, CVE-2022-50375, CVE-2022-50381, CVE-2022-50385, CVE-2022-50386, CVE-2022-50389, CVE-2022-50396, CVE-2022-50401, CVE-2022-50402, CVE-2022-50405, CVE-2022-50406, CVE-2022-50408, CVE-2022-50409, CVE-2022-50410, CVE-2022-50411, CVE-2022-50414, CVE-2022-50419, CVE-2022-50422, CVE-2022-50432, CVE-2022-50434, CVE-2022-50435, CVE-2022-50440, CVE-2022-50456, CVE-2022-50460, CVE-2023-1380, CVE-2023-28328, CVE-2023-3772, CVE-2023-39197, CVE-2023-53147, CVE-2023-53148, CVE-2023-53149, CVE-2023-53150, CVE-2023-53151, CVE-2023-53153, CVE-2023-53165, CVE-2023-53174, CVE-2023-53176, CVE-2023-53178, CVE-2023-53189, CVE-2023-53199, CVE-2023-53201, CVE-2023-53213, CVE-2023-53215, CVE-2023-53226, CVE-2023-53245, CVE-2023-53246, CVE-2023-53248, CVE-2023-53250, CVE-2023-53254, CVE-2023-53265, CVE-2023-53270, CVE-2023-53272, CVE-2023-53277, CVE-2023-53280, CVE-2023-53288, CVE-2023-53295, CVE-2023-53298, CVE-2023-53299, CVE-2023-53302, CVE-2023-53305, CVE-2023-53307, CVE-2023-53308, CVE-2023-53309, CVE-2023-53313, CVE-2023-53317, CVE-2023-53321, CVE-2023-53322, CVE-2023-53326, CVE-2023-53331, CVE-2023-53332, CVE-2023-53333, CVE-2023-53335, CVE-2023-53344, CVE-2023-53348, CVE-2023-53357, CVE-2023-53365, CVE-2023-53368, CVE-2023-53380, CVE-2023-53384, CVE-2023-53393, CVE-2023-53395, CVE-2023-53397, CVE-2023-53400, CVE-2023-53427, CVE-2023-53436, CVE-2023-53438, CVE-2023-53441, CVE-2023-53446, CVE-2023-53451, CVE-2023-53456, CVE-2023-53499, CVE-2023-53506, CVE-2023-53512, CVE-2023-53521, CVE-2023-53526, CVE-2023-53530, CVE-2024-53194, CVE-2024-58240, CVE-2025-38465, CVE-2025-38488, CVE-2025-38527, CVE-2025-38553, CVE-2025-38572, CVE-2025-38574, CVE-2025-38602, CVE-2025-38604, CVE-2025-38623, CVE-2025-38624, CVE-2025-38632, CVE-2025-38639, CVE-2025-38665, CVE-2025-38685, CVE-2025-38701, CVE-2025-38702, CVE-2025-38705, CVE-2025-38712, CVE-2025-38713, CVE-2025-38727, CVE-2025-38729, CVE-2025-38735, CVE-2025-39677, CVE-2025-39691, CVE-2025-39705, CVE-2025-39706, CVE-2025-39726, CVE-2025-39751, CVE-2025-39754, CVE-2025-39757, CVE-2025-39760, CVE-2025-39763, CVE-2025-39764, CVE-2025-39773, CVE-2025-39782, CVE-2025-39787, CVE-2025-39800, CVE-2025-39808, CVE-2025-39824, CVE-2025-39833, CVE-2025-39838, CVE-2025-39847, CVE-2025-39853, CVE-2025-39860, CVE-2025-39863, CVE-2025-39865, CVE-2025-39869, CVE-2025-39885, CVE-2025-40300
Maintenance Incident: [SUSE:Maintenance:41049](https://smelt.suse.de/incident/41049/)
Sources used:
SUSE Linux Enterprise Server 12 SP5 LTSS (src):
 kernel-source-4.12.14-122.275.1, kernel-syms-4.12.14-122.275.1
SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (src):
 kernel-source-4.12.14-122.275.1, kernel-syms-4.12.14-122.275.1
SUSE Linux Enterprise Live Patching 12-SP5 (src):
 kgraft-patch-SLE12-SP5_Update_73-1-8.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.