CVE-2022-49875

bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without FILE

State: Published
Severity: 5.5 Medium
Published: May 1, 2025
Updated: May 11, 2026
Reserved: May 1, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without FILE

When using bpftool to pin {PROG, MAP, LINK} without FILE, segmentation fault will occur. The reson is that the lack of FILE will cause strlen to trigger NULL pointer dereference. The corresponding stacktrace is shown below:

do_pin do_pin_any do_pin_fd mount_bpffs_for_pin strlen(name) <- NULL pointer dereference

Fix it by adding validation to the common process.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	75a1e792c335b5c6d7fdb1014da47aeb64c5944f to before 8c80b2fca4112d724dde477aed13f7b0510a2792Affected 75a1e792c335b5c6d7fdb1014da47aeb64c5944f to before 6dcdd1b68b7f9333d48d48fc77b75e7f235f6a4aAffected 75a1e792c335b5c6d7fdb1014da47aeb64c5944f to before da5161ba94c5e9182c301dd4f09c94f715c068bdAffected 75a1e792c335b5c6d7fdb1014da47aeb64c5944f to before 34de8e6e0e1f66e431abf4123934a2581cb5f133Affected
LinuxLinux	5.7Affected before 5.7Not affected 5.10.155 through 5.10.Not affected 5.15.79 through 5.15.Not affected 6.0.9 through 6.0.*Not affected 6.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.