NULL pointer dereference in Linux
CVE-2022-49962
In the Linux kernel, the following vulnerability has been resolved: xhci: Fix null pointer dereference in remove if xHC has only one roothub The remove path in xhci platform driver tries to remove and put both main and shared hcds even if only a main hcd exists (one roothub) This causes a null pointer dereference in reboot for those controllers. Check that the shared_hcd exists before trying to remove it.
EPSS: 0.002 (8.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Linux — versions e0fe986972f5b6b12086c73569206dd29c520be9, 5.19, 0
- Linux Linux_kernel — versions 6.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2022-49962?
- CVE-2022-49962 is a medium-severity vulnerability in Linux, classified under NULL Pointer Dereference. CVSS score: 5.5/10. Published 2025-06-18.
- How severe is CVE-2022-49962?
- Medium severity. CVSS v3 base score is 5.5 out of 10.