---
id: CVE-2022-49797
title: >-
  tracing: kprobe: Fix potential null-ptr-deref on trace_event_file in
  kprobe_event_gen_test_exit()
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  tracing: kprobe: Fix potential null-ptr-deref on trace_event_file in
  kprobe_event_gen_test_exit()


  When trace_get_event_file() failed, gen_kretprobe_test will be assign…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 64836248dda20c8e7427b493f7e06d9bf8f58850 <
    bb70fcae4115d24b7e8cee17a6da8b1943f546bb
  - >-
    Linux >= 64836248dda20c8e7427b493f7e06d9bf8f58850 <
    3a41c0f2a5c3bf72b4c4e9dd4b1025378201e332
  - >-
    Linux >= 64836248dda20c8e7427b493f7e06d9bf8f58850 <
    fd0efd4f7bfe611a8339ba01bc2ac3c33e79159d
  - >-
    Linux >= 64836248dda20c8e7427b493f7e06d9bf8f58850 <
    e0d75267f59d7084e0468bd68beeb1bf9c71d7c0
  - Linux 5.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T19:48:29.536913Z'
published: '2025-05-01'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:49:49.309Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-49797'
references:
  - url: 'https://git.kernel.org/stable/c/bb70fcae4115d24b7e8cee17a6da8b1943f546bb'
  - url: 'https://git.kernel.org/stable/c/3a41c0f2a5c3bf72b4c4e9dd4b1025378201e332'
  - url: 'https://git.kernel.org/stable/c/fd0efd4f7bfe611a8339ba01bc2ac3c33e79159d'
  - url: 'https://git.kernel.org/stable/c/e0d75267f59d7084e0468bd68beeb1bf9c71d7c0'
tags:
  - cve.org
epss: 0.00202
epssPercentile: 0.10136
ingestedAt: '2026-11-05T22:38:31.596Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tracing: kprobe: Fix potential null-ptr-deref on trace_event_file in kprobe_event_gen_test_exit()

When trace_get_event_file() failed, gen_kretprobe_test will be assigned
as the error code. If module kprobe_event_gen_test is removed now, the
null pointer dereference will happen in kprobe_event_gen_test_exit().
Check if gen_kprobe_test or gen_kretprobe_test is error code or NULL
before dereference them.

BUG: kernel NULL pointer dereference, address: 0000000000000012
PGD 0 P4D 0
Oops: 0000 [#1] SMP PTI
CPU: 3 PID: 2210 Comm: modprobe Not tainted
6.1.0-rc1-00171-g2159299a3b74-dirty #217
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
RIP: 0010:kprobe_event_gen_test_exit+0x1c/0xb5 [kprobe_event_gen_test]
Code: Unable to access opcode bytes at 0xffffffff9ffffff2.
RSP: 0018:ffffc900015bfeb8 EFLAGS: 00010246
RAX: ffffffffffffffea RBX: ffffffffa0002080 RCX: 0000000000000000
RDX: ffffffffa0001054 RSI: ffffffffa0001064 RDI: ffffffffdfc6349c
RBP: ffffffffa0000000 R08: 0000000000000004 R09: 00000000001e95c0
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000800
R13: ffffffffa0002420 R14: 0000000000000000 R15: 0000000000000000
FS:  00007f56b75be540(0000) GS:ffff88813bc00000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffff9ffffff2 CR3: 000000010874a006 CR4: 0000000000330ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __x64_sys_delete_module+0x206/0x380
 ? lockdep_hardirqs_on_prepare+0xd8/0x190
 ? syscall_enter_from_user_mode+0x1c/0x50
 do_syscall_64+0x3f/0x90
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

## Affected

- `Linux >= 64836248dda20c8e7427b493f7e06d9bf8f58850 < bb70fcae4115d24b7e8cee17a6da8b1943f546bb`
- `Linux >= 64836248dda20c8e7427b493f7e06d9bf8f58850 < 3a41c0f2a5c3bf72b4c4e9dd4b1025378201e332`
- `Linux >= 64836248dda20c8e7427b493f7e06d9bf8f58850 < fd0efd4f7bfe611a8339ba01bc2ac3c33e79159d`
- `Linux >= 64836248dda20c8e7427b493f7e06d9bf8f58850 < e0d75267f59d7084e0468bd68beeb1bf9c71d7c0`
- `Linux 5.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.