{"id":"CVE-2022-49257","title":"watch_queue: Fix NULL dereference in error cleanup","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwatch_queue: Fix NULL dereference in error cleanup\n\nIn watch_queue_set_size(), the error cleanup code doesn't take account of\nthe fact that __free_page() can't handle a…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= c73be61cede5882f9605a852414db559c0ebedfd < 5ae75b4ed30322b42abaa75ef1b784addfdb7dc9","Linux >= c73be61cede5882f9605a852414db559c0ebedfd < 695c47cea02b9101e2fc2e7d36d552128592b347","Linux >= c73be61cede5882f9605a852414db559c0ebedfd < 112a2f9b0a8457794095a0450598f150724ec456","Linux >= c73be61cede5882f9605a852414db559c0ebedfd < b6f5ad3e45d19f9c4ee3e8a2aff829f28d68591d","Linux >= c73be61cede5882f9605a852414db559c0ebedfd < a635415a064e77bcfbf43da413fd9dfe0bbed9cb","Linux 5.8"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T19:44:49.727151Z"},"published":"2025-02-26","updated":"2026-11-05","sourceUpdated":"2026-11-05T19:49:37.858Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2022-49257","references":[{"url":"https://git.kernel.org/stable/c/5ae75b4ed30322b42abaa75ef1b784addfdb7dc9"},{"url":"https://git.kernel.org/stable/c/695c47cea02b9101e2fc2e7d36d552128592b347"},{"url":"https://git.kernel.org/stable/c/112a2f9b0a8457794095a0450598f150724ec456"},{"url":"https://git.kernel.org/stable/c/b6f5ad3e45d19f9c4ee3e8a2aff829f28d68591d"},{"url":"https://git.kernel.org/stable/c/a635415a064e77bcfbf43da413fd9dfe0bbed9cb"}],"tags":["cve.org"],"epss":0.00261,"epssPercentile":0.17997,"ingestedAt":"2026-11-05T22:38:31.569Z","slug":"CVE-2022-49257","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwatch_queue: Fix NULL dereference in error cleanup\n\nIn watch_queue_set_size(), the error cleanup code doesn't take account of\nthe fact that __free_page() can't handle a NULL pointer when trying to free\nup buffer pages that did get allocated.\n\nFix this by only calling __free_page() on the pages actually allocated.\n\nWithout the fix, this can lead to something like the following:\n\nBUG: KASAN: null-ptr-deref in __free_pages+0x1f/0x1b0 mm/page_alloc.c:5473\nRead of size 4 at addr 0000000000000034 by task syz-executor168/3599\n...\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106\n __kasan_report mm/kasan/report.c:446 [inline]\n kasan_report.cold+0x66/0xdf mm/kasan/report.c:459\n check_region_inline mm/kasan/generic.c:183 [inline]\n kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189\n instrument_atomic_read include/linux/instrumented.h:71 [inline]\n atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]\n page_ref_count include/linux/page_ref.h:67 [inline]\n put_page_testzero include/linux/mm.h:717 [inline]\n __free_pages+0x1f/0x1b0 mm/page_alloc.c:5473\n watch_queue_set_size+0x499/0x630 kernel/watch_queue.c:275\n pipe_ioctl+0xac/0x2b0 fs/pipe.c:632\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:874 [inline]\n __se_sys_ioctl fs/ioctl.c:860 [inline]\n __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\n## Affected\n\n- `Linux >= c73be61cede5882f9605a852414db559c0ebedfd < 5ae75b4ed30322b42abaa75ef1b784addfdb7dc9`\n- `Linux >= c73be61cede5882f9605a852414db559c0ebedfd < 695c47cea02b9101e2fc2e7d36d552128592b347`\n- `Linux >= c73be61cede5882f9605a852414db559c0ebedfd < 112a2f9b0a8457794095a0450598f150724ec456`\n- `Linux >= c73be61cede5882f9605a852414db559c0ebedfd < b6f5ad3e45d19f9c4ee3e8a2aff829f28d68591d`\n- `Linux >= c73be61cede5882f9605a852414db559c0ebedfd < a635415a064e77bcfbf43da413fd9dfe0bbed9cb`\n- `Linux 5.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}