CVE-2022-49509
Published: 26 February 2025
Summary
CVE-2022-49509 is a high-severity Exposure of Resource to Wrong Sphere (CWE-668) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 4.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2022-49509 is a vulnerability in the Linux kernel's max9286 I2C driver within the media subsystem. It triggers a kernel oops during module removal due to a use-after-free-like issue where the I2C client data no longer points to the max9286_priv structure but instead to a v4l2_subdev after max9286_init() calls v4l2_i2c_subdev_init(). This leads to a paging fault at an invalid virtual address during i2c_mux_del_adapters() in the max9286_remove() function, as observed in kernel version 5.15.5 on Freescale i.MX8QXP hardware.
A local attacker with low privileges (PR:L) can exploit this by unloading the max9286 module via rmmod, resulting in a kernel panic or oops. The CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) indicates potential for high confidentiality impact alongside high availability disruption through the crash, stemming from the invalid memory access.
Kernel patches address the issue by fixing max9286_remove() to handle the pointer correctly, removing the i2c_set_clientdata() call in max9286_probe() to avoid confusion, and adjusting max9286_init() to directly access the priv pointer without relying on i2c_get_clientdata(). These fixes are available in stable kernel repositories via commits such as 365ab7ebc24eebb42b9e020aeb440d51af8960cd, 579c77595dbbdfe4f2edf335899f86ac51eca4e9, 9dd783274c89c21a038d967b52a858a297e767f8, and a4ec75df70575cdf33d9638c7844e729bfe6ce24.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-54720
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: media: i2c: max9286: fix kernel oops when removing module When removing the max9286 module we get a kernel oops: Unable to handle kernel paging request at virtual address 000000aa00000094 Mem…
more
abort info: ESR = 0x96000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000880d85000 [000000aa00000094] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 96000004 [#1] PREEMPT SMP Modules linked in: fsl_jr_uio caam_jr rng_core libdes caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine max9271 authenc crct10dif_ce mxc_jpeg_encdec CPU: 2 PID: 713 Comm: rmmod Tainted: G C 5.15.5-00057-gaebcd29c8ed7-dirty #5 Hardware name: Freescale i.MX8QXP MEK (DT) pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : i2c_mux_del_adapters+0x24/0xf0 lr : max9286_remove+0x28/0xd0 [max9286] sp : ffff800013a9bbf0 x29: ffff800013a9bbf0 x28: ffff00080b6da940 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 x23: ffff000801a5b970 x22: ffff0008048b0890 x21: ffff800009297000 x20: ffff0008048b0f70 x19: 000000aa00000064 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000014 x13: 0000000000000000 x12: ffff000802da49e8 x11: ffff000802051918 x10: ffff000802da4920 x9 : ffff000800030098 x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff6364626d x5 : 8080808000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffffffffffffffff x1 : ffff00080b6da940 x0 : 0000000000000000 Call trace: i2c_mux_del_adapters+0x24/0xf0 max9286_remove+0x28/0xd0 [max9286] i2c_device_remove+0x40/0x110 __device_release_driver+0x188/0x234 driver_detach+0xc4/0x150 bus_remove_driver+0x60/0xe0 driver_unregister+0x34/0x64 i2c_del_driver+0x58/0xa0 max9286_i2c_driver_exit+0x1c/0x490 [max9286] __arm64_sys_delete_module+0x194/0x260 invoke_syscall+0x48/0x114 el0_svc_common.constprop.0+0xd4/0xfc do_el0_svc+0x2c/0x94 el0_svc+0x28/0x80 el0t_64_sync_handler+0xa8/0x130 el0t_64_sync+0x1a0/0x1a4 The Oops happens because the I2C client data does not point to max9286_priv anymore but to v4l2_subdev. The change happened in max9286_init() which calls v4l2_i2c_subdev_init() later on... Besides fixing the max9286_remove() function, remove the call to i2c_set_clientdata() in max9286_probe(), to avoid confusion, and make the necessary changes to max9286_init() so that it doesn't have to use i2c_get_clientdata() in order to fetch the pointer to priv.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Kernel use-after-free triggers oops/panic on module unload (local low-priv rmmod), directly enabling system exploitation for DoS with availability impact and possible memory disclosure.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly blocks the invalid memory dereference in i2c_mux_del_adapters() triggered by the corrupted i2c_get_clientdata() pointer in max9286_remove().
Requires the driver to validate or sanitize clientdata pointers before use, preventing the paging fault during module unload.
Mandates application of the upstream fixes (e.g., removal of erroneous i2c_set_clientdata() and corrected priv handling) that eliminate the root cause.