{"id":"DEBIAN-CVE-2022-49257","details":"In the Linux kernel, the following vulnerability has been resolved:  watch_queue: Fix NULL dereference in error cleanup  In watch_queue_set_size(), the error cleanup code doesn't take account of the fact that __free_page() can't handle a NULL pointer when trying to free up buffer pages that did get allocated.  Fix this by only calling __free_page() on the pages actually allocated.  Without the fix, this can lead to something like the following:  BUG: KASAN: null-ptr-deref in __free_pages+0x1f/0x1b0 mm/page_alloc.c:5473 Read of size 4 at addr 0000000000000034 by task syz-executor168/3599 ... Call Trace:  \u003cTASK\u003e  __dump_stack lib/dump_stack.c:88 [inline]  dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106  __kasan_report mm/kasan/report.c:446 [inline]  kasan_report.cold+0x66/0xdf mm/kasan/report.c:459  check_region_inline mm/kasan/generic.c:183 [inline]  kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189  instrument_atomic_read include/linux/instrumented.h:71 [inline]  atomic_read include/linux/atomic/atomic-instrumented.h:27 [inline]  page_ref_count include/linux/page_ref.h:67 [inline]  put_page_testzero include/linux/mm.h:717 [inline]  __free_pages+0x1f/0x1b0 mm/page_alloc.c:5473  watch_queue_set_size+0x499/0x630 kernel/watch_queue.c:275  pipe_ioctl+0xac/0x2b0 fs/pipe.c:632  vfs_ioctl fs/ioctl.c:51 [inline]  __do_sys_ioctl fs/ioctl.c:874 [inline]  __se_sys_ioctl fs/ioctl.c:860 [inline]  __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860  do_syscall_x64 arch/x86/entry/common.c:50 [inline]  do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80  entry_SYSCALL_64_after_hwframe+0x44/0xae","modified":"2026-09-01T16:05:30.403646307Z","published":"2025-02-26T07:01:02.597Z","upstream":["CVE-2022-49257"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2022-49257"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.17.3-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49257.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.17.3-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49257.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.17.3-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49257.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}