Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-49944: Linux kernel may leave power device unreleased, causing crash

CVE-2022-49944 · published 1 year ago

Summary

The Linux kernel’s USB Type‑C code can leave a power‑management entry active, which may later cause the system to try to use a missing object and crash. This happens when an internal cleanup function was added and then rolled back, leaving stale files in the system. Update the kernel to a version that includes the rollback or later fixes to restore proper cleanup.

What to do

Update linux kernel to version 5.19.8.
Update debian linux to version 6.0.2-1.
Update linux linux_kernel to version 5.19.8 or later.
Update linux linux to version 3d4044c9e6d2e3f11f1f8b5e0ee8647d3eb1afad or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	linux	linux_kernel	>= 5.19, < 5.19.8 6.0 `cpe:2.3:o:linux:linux_kernel::::::::`
–	linux	linux	< 3d4044c9e6d2e3f11f1f8b5e0ee8647d3eb1afad 5.19
Linux	linux	kernel	>= 5.19.0, < 5.19.8 Fix: upgrade to 5.19.8
Debian:12	debian	linux	< 6.0.2-1 Fix: upgrade to 6.0.2-1

Original advisory text

Revert "usb: typec: ucsi: add a common function ucsi_unregister_connectors()"

In the Linux kernel, the following vulnerability has been resolved: Revert "usb: typec: ucsi: add a common function ucsi_unregister_connectors()" The recent commit 87d0e2f41b8c ("usb: typec: ucsi: add a common function ucsi_unregister_connectors()") introduced a regression that caused NULL dereference at reading the power supply sysfs. It's a stale sysfs entry that should have been removed but remains with NULL ops. The commit changed the error handling to skip the entries after a NULL con->wq, and this leaves the power device unreleased. For addressing the regression, the straight revert is applied here. Further code improvements can be done from the scratch again.

References

https://git.kernel.org/stable/c/3d4044c9e6d2e3f11f1f8b5e0ee8647d3eb1afad URL
https://git.kernel.org/stable/c/5f73aa2cf8bef4a39baa1591c3144ede4788826e URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49944... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-49944 Vendor Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
https://security-tracker.debian.org/tracker/CVE-2022-49944 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

5.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-476NULL Pointer Dereference

Timeline

Published18 Jun 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2022-49944 · OSV

CVE-2022-49944 · NVD

CVE-2022-49944 · MITRE

DEBIAN-CVE-2022-49944 · OSV

Track software like this

Free during beta