---
id: CVE-2022-49824
title: 'ata: libata-transport: fix error handling in ata_tlink_add()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ata: libata-transport: fix error handling in ata_tlink_add()

  In ata_tlink_add(), the return value of transport_add_device() is
  not checked. As a result, it causes null…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d9027470b88631d0956ac37cdadfdeb9cdcf2c99 <
    7377a14598f6b04446c54bc4a50cd249470d6c6f
  - >-
    Linux >= d9027470b88631d0956ac37cdadfdeb9cdcf2c99 <
    67b219314628b90b3a314528e177335b0cd5c70b
  - >-
    Linux >= d9027470b88631d0956ac37cdadfdeb9cdcf2c99 <
    d5234480ca822bdcf03fe4d6a590ddcb854558f7
  - >-
    Linux >= d9027470b88631d0956ac37cdadfdeb9cdcf2c99 <
    cf0816f6322c5c37ee52655f928e91ecf32da103
  - Linux 2.6.37
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T19:49:49.002873Z'
published: '2025-05-01'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:00:08.171Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-49824'
references:
  - url: 'https://git.kernel.org/stable/c/7377a14598f6b04446c54bc4a50cd249470d6c6f'
  - url: 'https://git.kernel.org/stable/c/67b219314628b90b3a314528e177335b0cd5c70b'
  - url: 'https://git.kernel.org/stable/c/d5234480ca822bdcf03fe4d6a590ddcb854558f7'
  - url: 'https://git.kernel.org/stable/c/cf0816f6322c5c37ee52655f928e91ecf32da103'
tags:
  - cve.org
epss: 0.00215
epssPercentile: 0.11979
ingestedAt: '2026-11-05T22:38:31.612Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ata: libata-transport: fix error handling in ata_tlink_add()

In ata_tlink_add(), the return value of transport_add_device() is
not checked. As a result, it causes null-ptr-deref while removing
the module, because transport_remove_device() is called to remove
the device that was not added.

Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0
CPU: 33 PID: 13850 Comm: rmmod Kdump: loaded Tainted: G        W          6.1.0-rc3+ #12
pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : device_del+0x48/0x39c
lr : device_del+0x44/0x39c
Call trace:
 device_del+0x48/0x39c
 attribute_container_class_device_del+0x28/0x40
 transport_remove_classdev+0x60/0x7c
 attribute_container_device_trigger+0x118/0x120
 transport_remove_device+0x20/0x30
 ata_tlink_delete+0x88/0xb0 [libata]
 ata_tport_delete+0x2c/0x60 [libata]
 ata_port_detach+0x148/0x1b0 [libata]
 ata_pci_remove_one+0x50/0x80 [libata]
 ahci_remove_one+0x4c/0x8c [ahci]

Fix this by checking and handling return value of transport_add_device()
in ata_tlink_add().

## Affected

- `Linux >= d9027470b88631d0956ac37cdadfdeb9cdcf2c99 < 7377a14598f6b04446c54bc4a50cd249470d6c6f`
- `Linux >= d9027470b88631d0956ac37cdadfdeb9cdcf2c99 < 67b219314628b90b3a314528e177335b0cd5c70b`
- `Linux >= d9027470b88631d0956ac37cdadfdeb9cdcf2c99 < d5234480ca822bdcf03fe4d6a590ddcb854558f7`
- `Linux >= d9027470b88631d0956ac37cdadfdeb9cdcf2c99 < cf0816f6322c5c37ee52655f928e91ecf32da103`
- `Linux 2.6.37`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.