# CVE-2022-49802: ftrace: Fix null pointer dereference in ftrace_add_mod()

Status: published. Published: 2025-05-01. Updated: 2026-11-05.

In the Linux kernel, the following vulnerability has been resolved:

ftrace: Fix null pointer dereference in ftrace_add_mod()

The @ftrace_mod is allocated by kzalloc(), so both the members {prev,next}
of @ftrace_mode->list are NULL, it's not a valid state to call list_del().
If kstrdup() for @ftrace_mod->{func|module} fails, it goes to @out_free
tag and calls free_ftrace_mod() to destroy @ftrace_mod, then list_del()
will write prev->next and next->prev, where null pointer dereference
happens.

BUG: kernel NULL pointer dereference, address: 0000000000000008
Oops: 0002 [#1] PREEMPT SMP NOPTI
Call Trace:
 <TASK>
 ftrace_mod_callback+0x20d/0x220
 ? do_filp_open+0xd9/0x140
 ftrace_process_regex.isra.51+0xbf/0x130
 ftrace_regex_write.isra.52.part.53+0x6e/0x90
 vfs_write+0xee/0x3a0
 ? __audit_filter_op+0xb1/0x100
 ? auditd_test_task+0x38/0x50
 ksys_write+0xa5/0xe0
 do_syscall_64+0x3a/0x90
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Kernel panic - not syncing: Fatal exception

So call INIT_LIST_HEAD() to initialize the list member to fix this issue.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Linux / Linux: ≥ 673feb9d76ab3eddde7acfd94b206e321cfc90b9; < 665b4c6648bf2b91f69b33817f4321cf4c3cafe9 (affected, git); ≥ 673feb9d76ab3eddde7acfd94b206e321cfc90b9; < b5bfc61f541d3f092b13dedcfe000d86eb8e133c (affected, git); ≥ 673feb9d76ab3eddde7acfd94b206e321cfc90b9; < f715f31559b82e3f75ce047fa476de63d8107584 (affected, git); ≥ 673feb9d76ab3eddde7acfd94b206e321cfc90b9; < 6a14828caddad0d989495a72af678adf60992704 (affected, git); ≥ 673feb9d76ab3eddde7acfd94b206e321cfc90b9; < 1bea037a1abb23a6729bef36a2265a4565f5ea77 (affected, git); ≥ 673feb9d76ab3eddde7acfd94b206e321cfc90b9; < 6e50eb4b1807017f6c2d5089064256ce2de8aef1 (affected, git); ≥ 673feb9d76ab3eddde7acfd94b206e321cfc90b9; < 19ba6c8af9382c4c05dc6a0a79af3013b9a35cd0 (affected, git). Source: CNA: Linux
- Linux / Linux: 4.13 (affected); ≥ 0; < 4.13 (unaffected, semver); ≥ 4.14.300; ≤ 4.14.* (unaffected, semver); ≥ 4.19.267; ≤ 4.19.* (unaffected, semver); ≥ 5.4.225; ≤ 5.4.* (unaffected, semver); ≥ 5.10.156; ≤ 5.10.* (unaffected, semver); ≥ 5.15.80; ≤ 5.15.* (unaffected, semver); ≥ 6.0.10; ≤ 6.0.* (unaffected, semver); ≥ 6.1; ≤ * (unaffected, original_commit_for_fix). Source: CNA: Linux

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: 0.22% as of 2026-11-05; percentile 12.93%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: Not reported

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://git.kernel.org/stable/c/665b4c6648bf2b91f69b33817f4321cf4c3cafe9 (CNA: Linux)

- https://git.kernel.org/stable/c/b5bfc61f541d3f092b13dedcfe000d86eb8e133c (CNA: Linux)

- https://git.kernel.org/stable/c/f715f31559b82e3f75ce047fa476de63d8107584 (CNA: Linux)

- https://git.kernel.org/stable/c/6a14828caddad0d989495a72af678adf60992704 (CNA: Linux)

- https://git.kernel.org/stable/c/1bea037a1abb23a6729bef36a2265a4565f5ea77 (CNA: Linux)

- https://git.kernel.org/stable/c/6e50eb4b1807017f6c2d5089064256ce2de8aef1 (CNA: Linux)

- https://git.kernel.org/stable/c/19ba6c8af9382c4c05dc6a0a79af3013b9a35cd0 (CNA: Linux)

## Provenance

- CNA: Linux: https://www.cve.org/CVERecord?id=CVE-2022-49802; retrieved 2026-11-05; source updated 2026-11-05

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2022-49802; retrieved 2026-11-05; source updated Not reported

Revision: 5f3ab325fd2bd62c20be4924e53b28d71e938ebaf27e1017f5b4717220a89376

Canonical: https://y2.dev/cve/CVE-2022-49802

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.