GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49083 (GCVE-0-2022-49083)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:54 – Updated: 2026-05-11 18:52
VLAI
Title
iommu/omap: Fix regression in probe for NULL pointer dereference
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/omap: Fix regression in probe for NULL pointer dereference Commit 3f6634d997db ("iommu: Use right way to retrieve iommu_ops") started triggering a NULL pointer dereference for some omap variants: __iommu_probe_device from probe_iommu_group+0x2c/0x38 probe_iommu_group from bus_for_each_dev+0x74/0xbc bus_for_each_dev from bus_iommu_probe+0x34/0x2e8 bus_iommu_probe from bus_set_iommu+0x80/0xc8 bus_set_iommu from omap_iommu_init+0x88/0xcc omap_iommu_init from do_one_initcall+0x44/0x24 This is caused by omap iommu probe returning 0 instead of ERR_PTR(-ENODEV) as noted by Jason Gunthorpe <jgg@ziepe.ca>. Looks like the regression already happened with an earlier commit 6785eb9105e3 ("iommu/omap: Convert to probe/release_device() call-backs") that changed the function return type and missed converting one place.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6785eb9105e3363aa51408c700a55e8b5f88fcf6 , < bd905fed87ce01ac010011bb8f44ed0140116ceb (git)
Affected: 6785eb9105e3363aa51408c700a55e8b5f88fcf6 , < 47e239117bd97c8556f9187af7a9a7938db4e021 (git)
Affected: 6785eb9105e3363aa51408c700a55e8b5f88fcf6 , < ea518578aa8a9a0280605b53cc33f707e10c8178 (git)
Affected: 6785eb9105e3363aa51408c700a55e8b5f88fcf6 , < 1d89f2b9eadbcf3ce93c6d7238f68299a1f84968 (git)
Affected: 6785eb9105e3363aa51408c700a55e8b5f88fcf6 , < 71ff461c3f41f6465434b9e980c01782763e7ad8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.8
Unaffected: 0 , < 5.8 (semver)
Unaffected: 5.10.111 , ≤ 5.10.* (semver)
Unaffected: 5.15.34 , ≤ 5.15.* (semver)
Unaffected: 5.16.20 , ≤ 5.16.* (semver)
Unaffected: 5.17.3 , ≤ 5.17.* (semver)
Unaffected: 5.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/omap-iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bd905fed87ce01ac010011bb8f44ed0140116ceb",
              "status": "affected",
              "version": "6785eb9105e3363aa51408c700a55e8b5f88fcf6",
              "versionType": "git"
            },
            {
              "lessThan": "47e239117bd97c8556f9187af7a9a7938db4e021",
              "status": "affected",
              "version": "6785eb9105e3363aa51408c700a55e8b5f88fcf6",
              "versionType": "git"
            },
            {
              "lessThan": "ea518578aa8a9a0280605b53cc33f707e10c8178",
              "status": "affected",
              "version": "6785eb9105e3363aa51408c700a55e8b5f88fcf6",
              "versionType": "git"
            },
            {
              "lessThan": "1d89f2b9eadbcf3ce93c6d7238f68299a1f84968",
              "status": "affected",
              "version": "6785eb9105e3363aa51408c700a55e8b5f88fcf6",
              "versionType": "git"
            },
            {
              "lessThan": "71ff461c3f41f6465434b9e980c01782763e7ad8",
              "status": "affected",
              "version": "6785eb9105e3363aa51408c700a55e8b5f88fcf6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/omap-iommu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.111",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.34",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.20",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.3",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/omap: Fix regression in probe for NULL pointer dereference\n\nCommit 3f6634d997db (\"iommu: Use right way to retrieve iommu_ops\") started\ntriggering a NULL pointer dereference for some omap variants:\n\n__iommu_probe_device from probe_iommu_group+0x2c/0x38\nprobe_iommu_group from bus_for_each_dev+0x74/0xbc\nbus_for_each_dev from bus_iommu_probe+0x34/0x2e8\nbus_iommu_probe from bus_set_iommu+0x80/0xc8\nbus_set_iommu from omap_iommu_init+0x88/0xcc\nomap_iommu_init from do_one_initcall+0x44/0x24\n\nThis is caused by omap iommu probe returning 0 instead of ERR_PTR(-ENODEV)\nas noted by Jason Gunthorpe \u003cjgg@ziepe.ca\u003e.\n\nLooks like the regression already happened with an earlier commit\n6785eb9105e3 (\"iommu/omap: Convert to probe/release_device() call-backs\")\nthat changed the function return type and missed converting one place."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:52:42.349Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bd905fed87ce01ac010011bb8f44ed0140116ceb"
        },
        {
          "url": "https://git.kernel.org/stable/c/47e239117bd97c8556f9187af7a9a7938db4e021"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea518578aa8a9a0280605b53cc33f707e10c8178"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d89f2b9eadbcf3ce93c6d7238f68299a1f84968"
        },
        {
          "url": "https://git.kernel.org/stable/c/71ff461c3f41f6465434b9e980c01782763e7ad8"
        }
      ],
      "title": "iommu/omap: Fix regression in probe for NULL pointer dereference",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49083",
    "datePublished": "2025-02-26T01:54:42.582Z",
    "dateReserved": "2025-02-26T01:49:39.248Z",
    "dateUpdated": "2026-05-11T18:52:42.349Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49083",
      "date": "2026-09-16",
      "epss": "0.00241",
      "percentile": "0.15437"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49083\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:00:45.643\",\"lastModified\":\"2026-06-17T05:17:02.003\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommu/omap: Fix regression in probe for NULL pointer dereference\\n\\nCommit 3f6634d997db (\\\"iommu: Use right way to retrieve iommu_ops\\\") started\\ntriggering a NULL pointer dereference for some omap variants:\\n\\n__iommu_probe_device from probe_iommu_group+0x2c/0x38\\nprobe_iommu_group from bus_for_each_dev+0x74/0xbc\\nbus_for_each_dev from bus_iommu_probe+0x34/0x2e8\\nbus_iommu_probe from bus_set_iommu+0x80/0xc8\\nbus_set_iommu from omap_iommu_init+0x88/0xcc\\nomap_iommu_init from do_one_initcall+0x44/0x24\\n\\nThis is caused by omap iommu probe returning 0 instead of ERR_PTR(-ENODEV)\\nas noted by Jason Gunthorpe \u003cjgg@ziepe.ca\u003e.\\n\\nLooks like the regression already happened with an earlier commit\\n6785eb9105e3 (\\\"iommu/omap: Convert to probe/release_device() call-backs\\\")\\nthat changed the function return type and missed converting one place.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: iommu/omap: Se corrige la regresi\u00f3n en la sonda para la desreferencia de puntero NULL. el commit 3f6634d997db (\\\"iommu: Use la forma correcta de recuperar iommu_ops\\\") comenz\u00f3 a activar una desreferencia de puntero NULL para algunas variantes de omap: __iommu_probe_device de probe_iommu_group+0x2c/0x38 probe_iommu_group de bus_for_each_dev+0x74/0xbc bus_for_each_dev de bus_iommu_probe+0x34/0x2e8 bus_iommu_probe de bus_set_iommu+0x80/0xc8 bus_set_iommu de omap_iommu_init+0x88/0xcc omap_iommu_init de do_one_initcall+0x44/0x24 Esto se debe a que la sonda omap iommu devuelve 0 en lugar de ERR_PTR(-ENODEV), como lo se\u00f1al\u00f3 Jason Gunthorpe . Parece que la regresi\u00f3n ya ocurri\u00f3 con una confirmaci\u00f3n anterior 6785eb9105e3 (\\\"iommu/omap: Convertir a devoluciones de llamada de probe/release_device()\\\") que cambi\u00f3 el tipo de retorno de la funci\u00f3n y no realiz\u00f3 la conversi\u00f3n en un lugar.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/iommu/omap-iommu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6785eb9105e3363aa51408c700a55e8b5f88fcf6\",\"lessThan\":\"bd905fed87ce01ac010011bb8f44ed0140116ceb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6785eb9105e3363aa51408c700a55e8b5f88fcf6\",\"lessThan\":\"47e239117bd97c8556f9187af7a9a7938db4e021\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6785eb9105e3363aa51408c700a55e8b5f88fcf6\",\"lessThan\":\"ea518578aa8a9a0280605b53cc33f707e10c8178\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6785eb9105e3363aa51408c700a55e8b5f88fcf6\",\"lessThan\":\"1d89f2b9eadbcf3ce93c6d7238f68299a1f84968\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6785eb9105e3363aa51408c700a55e8b5f88fcf6\",\"lessThan\":\"71ff461c3f41f6465434b9e980c01782763e7ad8\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/iommu/omap-iommu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.111\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.34\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16.20\",\"lessThanOrEqual\":\"5.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17.3\",\"lessThanOrEqual\":\"5.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.8\",\"versionEndExcluding\":\"5.10.111\",\"matchCriteriaId\":\"0938424F-D5D9-4907-8926-62CEBB19AF8A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.34\",\"matchCriteriaId\":\"D25878D3-7761-4E9F-8919-E92CD53896E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.20\",\"matchCriteriaId\":\"ABBBA66E-0244-4621-966B-9790AF1EEB00\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17\",\"versionEndExcluding\":\"5.17.3\",\"matchCriteriaId\":\"AE420AC7-1E59-4398-B84F-71F4B4337762\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.18:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6AD94161-84BB-42E6-9882-4FC0C42E9FC1\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1d89f2b9eadbcf3ce93c6d7238f68299a1f84968\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/47e239117bd97c8556f9187af7a9a7938db4e021\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/71ff461c3f41f6465434b9e980c01782763e7ad8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bd905fed87ce01ac010011bb8f44ed0140116ceb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ea518578aa8a9a0280605b53cc33f707e10c8178\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:21:11+00:00",
      "cve": "CVE-2022-49083",
      "id": "CVE-2022-49083",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iommu/omap: Fix regression in probe for NULL pointer dereference",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49083.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-04T00:35:28Z",
      "cve": "CVE-2022-49083",
      "id": "CVE-2022-49083",
      "initial_release_date": "2025-02-27T03:12:33Z",
      "product_status:known_affected": "334",
      "product_status:known_not_affected": "369",
      "product_status:recommended": "293",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49083",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49083.json",
      "version": "49"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.