CVE-2022-49262 crypto: octeontx2 - remove CONFIG_DM_CRYPT check
A NULL pointer dereference in the OcteonTX2 crypto driver causes a kernel crash when the driver is removed with dm-crypt enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-49262?
CVE-2022-49262 is a medium-severity vulnerability in Linux kernel, published on 26 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
crypto: octeontx2 - remove CONFIG_DM_CRYPT check
No issues were found while using the driver with dm-crypt enabled. So CONFIG_DM_CRYPT check in the driver can be removed.
This also fixes the NULL pointer dereference in driver release if CONFIG_DM_CRYPT is enabled.
... Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 ... Call trace: crypto_unregister_alg+0x68/0xfc crypto_unregister_skciphers+0x44/0x60 otx2_cpt_crypto_exit+0x100/0x1a0 otx2_cptvf_remove+0xf8/0x200 pci_device_remove+0x3c/0xd4 __device_release_driver+0x188/0x234 device_release_driver+0x2c/0x4c ...
Weakness: CWE-476
Which versions are affected by CVE-2022-49262?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-49262?
Apply the vendor's patch.
Is CVE-2022-49262 being exploited?
There is no known exploitation of CVE-2022-49262 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-49262, GHSA-mcp5-gm6h-cfh4, UBUNTU-CVE-2022-49262.