01 Record

CVE-2022-49505

NFC: NULL out the dev->rfkill to prevent UAF

HighPUBLISHEDCNA: Linux

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

NFC: NULL out the dev->rfkill to prevent UAF

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.28% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 20.6% of scored records. A rank, not a probability.

NVD base score

7.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Analyzed. NVD last modified this record on 2026-06-17.

Red Hat severity

Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2025-02-26 02:13Z1 YR AGO

Last updated

2026-08-05 08:55Z2 MO AGO

Reserved

2025-02-26

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.8)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-416Use After FreeVariant

Data version

5.2

Document digest

6544df44aada3db66a2f0f2fe4ed9163ab043f7418d610992ad94bbdb1bda198

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxff169909eac9e00bf1aa0af739ba6ddfb1b1d135 to < a8e03bcad52dc9afabf650fdbad84f739cec9efa, 47244ac0b65bd74cc70007d8e1bac68bd2baad19 to < f81270125b50532624400063281e6611ecd61ddf, c45cea83e13699bdfd47842e04d09dd43af4c371 to < 6abfaca8711803d0d7cc8c0fac1070a88509d463, 307d2e6cebfca9d92f86c8e2c8e3dd4a8be46ba6 to < fbf9c4c714d3cdeb98b6a18e4d057f931cad1d81, 73a0d12114b4bc1a9def79a623264754b9df698e to < 2a1b5110c95e4d49c8c3906270dfcde680a5a7be, 8a9c61c3ef187d8891225f9b932390670a43a0d3 to < 1632be63862f183cd5cf1cc094e698e6ec005dfd, 3e3b5dfcd16a3e254aab61bd1e8c417dd4503102 to < 4a68938f43b7c2663e4c90bb9bbe29ac8b9a42a0, 3e3b5dfcd16a3e254aab61bd1e8c417dd4503102 to < 4f5d71930f41be78557f9714393179025baacd65, 3e3b5dfcd16a3e254aab61bd1e8c417dd4503102 to < 1b0e81416a24d6e9b8c2341e22e8bf48f8b8bfc9, 5ef16d2d172ee56714cff37cd005b98aba08ef5a, 4.9.291 to < 4.9.318, 4.14.256 to < 4.14.283, 4.19.218 to < 4.19.247, 5.4.162 to < 5.4.198, 5.10.82 to < 5.10.121, 5.15.5 to < 5.15.46, 4.4.293 to < 4.5, 5.16—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/a8e03bcad52dc9afabf650fdbad84f739cec9efa
git.kernel.orghttps://git.kernel.org/stable/c/f81270125b50532624400063281e6611ecd61ddf
git.kernel.orghttps://git.kernel.org/stable/c/6abfaca8711803d0d7cc8c0fac1070a88509d463
git.kernel.orghttps://git.kernel.org/stable/c/fbf9c4c714d3cdeb98b6a18e4d057f931cad1d81
git.kernel.orghttps://git.kernel.org/stable/c/2a1b5110c95e4d49c8c3906270dfcde680a5a7be
git.kernel.orghttps://git.kernel.org/stable/c/1632be63862f183cd5cf1cc094e698e6ec005dfd
git.kernel.orghttps://git.kernel.org/stable/c/4a68938f43b7c2663e4c90bb9bbe29ac8b9a42a0
git.kernel.orghttps://git.kernel.org/stable/c/4f5d71930f41be78557f9714393179025baacd65
git.kernel.orghttps://git.kernel.org/stable/c/1b0e81416a24d6e9b8c2341e22e8bf48f8b8bfc9

07 Fixed in

Debian 12

linux
Fixed in 5.18.5-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 5.18.5-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 5.18.5-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.