{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2022-49007 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2022-49007 is a medium-severity vulnerability in Linux kernel, published on 21 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-49007 and fix it if it is affected.\n\nWhat it is: CVE-2022-49007 is a medium-severity vulnerability in Linux kernel, published on 21 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2022-49007 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-49007/ (Markdown: https://insights.sbomify.com/CVE-2022-49007/index.md)","id":"CVE-2022-49007","markdown":"https://insights.sbomify.com/CVE-2022-49007/index.md","name":"CVE-2022-49007","record":{"aliases":["DEBIAN-CVE-2022-49007","GHSA-9mmp-2f66-mf43","UBUNTU-CVE-2022-49007"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A NULL pointer dereference in the nilfs2 filesystem allows local attackers to cause a system crash via crafted operations.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-476","name":"NULL Pointer Dereference"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()\n\nSyzbot reported a null-ptr-deref bug:\n\n NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP\n frequency \u003c 30 seconds\n general protection fault, probably for non-canonical address\n 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n CPU: 1 PID: 3603 Comm: segctord Not tainted\n 6.1.0-rc2-syzkaller-00105-gb229b6ca5abb #0\n Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google\n 10/11/2022\n RIP: 0010:nilfs_palloc_commit_free_entry+0xe5/0x6b0\n fs/nilfs2/alloc.c:608\n Code: 00 00 00 00 fc ff df 80 3c 02 00 0f 85 cd 05 00 00 48 b8 00 00 00\n 00 00 fc ff df 4c 8b 73 08 49 8d 7e 10 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02\n 00 0f 85 26 05 00 00 49 8b 46 10 be a6 00 00 00 48 c7 c7\n RSP: 0018:ffffc90003dff830 EFLAGS: 00010212\n RAX: dffffc0000000000 RBX: ffff88802594e218 RCX: 000000000000000d\n RDX: 0000000000000002 RSI: 0000000000002000 RDI: 0000000000000010\n RBP: ffff888071880222 R08: 0000000000000005 R09: 000000000000003f\n R10: 000000000000000d R11: 0000000000000000 R12: ffff888071880158\n R13: ffff88802594e220 R14: 0000000000000000 R15: 0000000000000004\n FS:  0000000000000000(0000) GS:ffff8880b9b00000(0000)\n knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007fb1c08316a8 CR3: 0000000018560000 CR4: 0000000000350ee0\n Call Trace:\n  \u003cTASK\u003e\n  nilfs_dat_commit_free fs/nilfs2/dat.c:114 [inline]\n  nilfs_dat_commit_end+0x464/0x5f0 fs/nilfs2/dat.c:193\n  nilfs_dat_commit_update+0x26/0x40 fs/nilfs2/dat.c:236\n  nilfs_btree_commit_update_v+0x87/0x4a0 fs/nilfs2/btree.c:1940\n  nilfs_btree_commit_propagate_v fs/nilfs2/btree.c:2016 [inline]\n  nilfs_btree_propagate_v fs/nilfs2/btree.c:2046 [inline]\n  nilfs_btree_propagate+0xa00/0xd60 fs/nilfs2/btree.c:2088\n  nilfs_bmap_propagate+0x73/0x170 fs/nilfs2/bmap.c:337\n  nilfs_collect_file_data+0x45/0xd0 fs/nilfs2/segment.c:568\n  nilfs_segctor_apply_buffers+0x14a/0x470 fs/nilfs2/segment.c:1018\n  nilfs_segctor_scan_file+0x3f4/0x6f0 fs/nilfs2/segment.c:1067\n  nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1197 [inline]\n  nilfs_segctor_collect fs/nilfs2/segment.c:1503 [inline]\n  nilfs_segctor_do_construct+0x12fc/0x6af0 fs/nilfs2/segment.c:2045\n  nilfs_segctor_construct+0x8e3/0xb30 fs/nilfs2/segment.c:2379\n  nilfs_segctor_thread_construct fs/nilfs2/segment.c:2487 [inline]\n  nilfs_segctor_thread+0x3c3/0xf30 fs/nilfs2/segment.c:2570\n  kthread+0x2e4/0x3a0 kernel/kthread.c:376\n  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306\n  \u003c/TASK\u003e\n ...\n\nIf DAT metadata file is corrupted on disk, there is a case where\nreq-\u003epr_desc_bh is NULL and blocknr is 0 at nilfs_dat_commit_end() during\na b-tree operation that cascadingly updates ancestor nodes of the b-tree,\nbecause nilfs_dat_commit_alloc() for a lower level block can initialize\nthe blocknr on the same DAT entry between nilfs_dat_prepare_end() and\nnilfs_dat_commit_end().\n\nIf this happens, nilfs_dat_commit_end() calls nilfs_dat_commit_free()\nwithout valid buffer heads in req-\u003epr_desc_bh and req-\u003epr_bitmap_bh, and\ncauses the NULL pointer dereference above in\nnilfs_palloc_commit_free_entry() function, which leads to a crash.\n\nFix this by adding a NULL check on req-\u003epr_desc_bh and req-\u003epr_bitmap_bh\nbefore nilfs_palloc_commit_free_entry() in nilfs_dat_commit_free().\n\nThis also calls nilfs_error() in that case to notify that there is a fatal\nflaw in the filesystem metadata and prevent further operations.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()","id":"CVE-2022-49007","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"null_dereference","year":"2022"},"n_packages":0,"n_references":8,"next":{"headline":"can: can327: can327_feed_frame_to_netdev(): fix potential skb leak when netdev is down","id":"CVE-2022-49008"},"packages":[],"prev":{"headline":"tracing: Free buffers when a used dynamic event is removed","id":"CVE-2022-49006"},"products":["Linux"],"published":"2024-10-21","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"A NULL pointer dereference in the nilfs2 filesystem allows local attackers to cause a system crash via crafted operations.","url":"https://insights.sbomify.com/CVE-2022-49007/"}