{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2022-49427 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2022-49427 is a medium-severity denial of service vulnerability in Linux kernel, published on 26 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-49427 and fix it if it is affected.\n\nWhat it is: CVE-2022-49427 is a medium-severity denial of service vulnerability in Linux kernel, published on 26 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2022-49427 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-49427/ (Markdown: https://insights.sbomify.com/CVE-2022-49427/index.md)","id":"CVE-2022-49427","markdown":"https://insights.sbomify.com/CVE-2022-49427/index.md","name":"CVE-2022-49427","record":{"aliases":["DEBIAN-CVE-2022-49427","GHSA-q88h-gvfq-84pc","UBUNTU-CVE-2022-49427"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"low_privilege","summary":"A kernel warning triggered by redundant clock disabling during device removal can lead to system instability or denial of service.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/mediatek: Remove clk_disable in mtk_iommu_remove\n\nAfter the commit b34ea31fe013 (\"iommu/mediatek: Always enable the clk on\nresume\"), the iommu clock is controlled by the runtime callback.\nthus remove the clk control in the mtk_iommu_remove.\n\nOtherwise, it will warning like:\n\necho 14018000.iommu \u003e /sys/bus/platform/drivers/mtk-iommu/unbind\n\n[   51.413044] ------------[ cut here ]------------\n[   51.413648] vpp0_smi_iommu already disabled\n[   51.414233] WARNING: CPU: 2 PID: 157 at */v5.15-rc1/kernel/mediatek/\n                          drivers/clk/clk.c:952 clk_core_disable+0xb0/0xb8\n[   51.417174] Hardware name: MT8195V/C(ENG) (DT)\n[   51.418635] pc : clk_core_disable+0xb0/0xb8\n[   51.419177] lr : clk_core_disable+0xb0/0xb8\n...\n[   51.429375] Call trace:\n[   51.429694]  clk_core_disable+0xb0/0xb8\n[   51.430193]  clk_core_disable_lock+0x24/0x40\n[   51.430745]  clk_disable+0x20/0x30\n[   51.431189]  mtk_iommu_remove+0x58/0x118\n[   51.431705]  platform_remove+0x28/0x60\n[   51.432197]  device_release_driver_internal+0x110/0x1f0\n[   51.432873]  device_driver_detach+0x18/0x28\n[   51.433418]  unbind_store+0xd4/0x108\n[   51.433886]  drv_attr_store+0x24/0x38\n[   51.434363]  sysfs_kf_write+0x40/0x58\n[   51.434843]  kernfs_fop_write_iter+0x164/0x1e0","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"iommu/mediatek: Remove clk_disable in mtk_iommu_remove","id":"CVE-2022-49427","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"denial_of_service","year":"2022"},"n_packages":0,"n_references":4,"next":{"headline":"f2fs: fix to do sanity check on inline_dots inode","id":"CVE-2022-49428"},"packages":[],"prev":{"headline":"iommu/arm-smmu-v3-sva: Fix mm use-after-free","id":"CVE-2022-49426"},"products":["Linux"],"published":"2025-02-26","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-05-23","vendors":["Linux"]},"summary":"A kernel warning triggered by redundant clock disabling during device removal can lead to system instability or denial of service.","url":"https://insights.sbomify.com/CVE-2022-49427/"}