---
id: CVE-2022-49257
title: 'watch_queue: Fix NULL dereference in error cleanup'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  watch_queue: Fix NULL dereference in error cleanup

  In watch_queue_set_size(), the error cleanup code doesn't take account of
  the fact that __free_page() can't handle a…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c73be61cede5882f9605a852414db559c0ebedfd <
    5ae75b4ed30322b42abaa75ef1b784addfdb7dc9
  - >-
    Linux >= c73be61cede5882f9605a852414db559c0ebedfd <
    695c47cea02b9101e2fc2e7d36d552128592b347
  - >-
    Linux >= c73be61cede5882f9605a852414db559c0ebedfd <
    112a2f9b0a8457794095a0450598f150724ec456
  - >-
    Linux >= c73be61cede5882f9605a852414db559c0ebedfd <
    b6f5ad3e45d19f9c4ee3e8a2aff829f28d68591d
  - >-
    Linux >= c73be61cede5882f9605a852414db559c0ebedfd <
    a635415a064e77bcfbf43da413fd9dfe0bbed9cb
  - Linux 5.8
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T19:44:49.727151Z'
published: '2025-02-26'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:49:37.858Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-49257'
references:
  - url: 'https://git.kernel.org/stable/c/5ae75b4ed30322b42abaa75ef1b784addfdb7dc9'
  - url: 'https://git.kernel.org/stable/c/695c47cea02b9101e2fc2e7d36d552128592b347'
  - url: 'https://git.kernel.org/stable/c/112a2f9b0a8457794095a0450598f150724ec456'
  - url: 'https://git.kernel.org/stable/c/b6f5ad3e45d19f9c4ee3e8a2aff829f28d68591d'
  - url: 'https://git.kernel.org/stable/c/a635415a064e77bcfbf43da413fd9dfe0bbed9cb'
tags:
  - cve.org
epss: 0.00261
epssPercentile: 0.17997
ingestedAt: '2026-11-05T22:38:31.569Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

watch_queue: Fix NULL dereference in error cleanup

In watch_queue_set_size(), the error cleanup code doesn't take account of
the fact that __free_page() can't handle a NULL pointer when trying to free
up buffer pages that did get allocated.

Fix this by only calling __free_page() on the pages actually allocated.

Without the fix, this can lead to something like the following:

BUG: KASAN: null-ptr-deref in __free_pages+0x1f/0x1b0 mm/page_alloc.c:5473
Read of size 4 at addr 0000000000000034 by task syz-executor168/3599
...
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 __kasan_report mm/kasan/report.c:446 [inline]
 kasan_report.cold+0x66/0xdf mm/kasan/report.c:459
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189
 instrument_atomic_read include/linux/instrumented.h:71 [inline]
 atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]
 page_ref_count include/linux/page_ref.h:67 [inline]
 put_page_testzero include/linux/mm.h:717 [inline]
 __free_pages+0x1f/0x1b0 mm/page_alloc.c:5473
 watch_queue_set_size+0x499/0x630 kernel/watch_queue.c:275
 pipe_ioctl+0xac/0x2b0 fs/pipe.c:632
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl fs/ioctl.c:860 [inline]
 __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

## Affected

- `Linux >= c73be61cede5882f9605a852414db559c0ebedfd < 5ae75b4ed30322b42abaa75ef1b784addfdb7dc9`
- `Linux >= c73be61cede5882f9605a852414db559c0ebedfd < 695c47cea02b9101e2fc2e7d36d552128592b347`
- `Linux >= c73be61cede5882f9605a852414db559c0ebedfd < 112a2f9b0a8457794095a0450598f150724ec456`
- `Linux >= c73be61cede5882f9605a852414db559c0ebedfd < b6f5ad3e45d19f9c4ee3e8a2aff829f28d68591d`
- `Linux >= c73be61cede5882f9605a852414db559c0ebedfd < a635415a064e77bcfbf43da413fd9dfe0bbed9cb`
- `Linux 5.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.