What’s Vulnerable › Vulnerabilities

CVE-2022-48879: efi: fix NULL-deref in init error path

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-08-21 · updated 2026-06-17
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: efi: fix NULL-deref in init error path In cases where runtime services are not supported or have been disabled, the runtime services workqueue will never have been allocated. Do not try to destroy the workqueue unconditionally in the unlikely event that EFI initialisation fails to avoid dereferencing a NULL pointer.

Affected products

• Linux kernel: from 4.19.142 before 4.19.270; from 5.4.61 before 5.4.229; from 5.9 before 5.10.164; from 5.11 before 5.15.89; from 5.16 before 6.1.7 — fixed in 4.19.270, 5.10.164, 5.15.89, 5.4.229, 6.1.7

How to fix

Upgrade to a fixed version: Linux kernel 4.19.270, 5.10.164, 5.15.89, 5.4.229. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/4ca71bc0e1995d15486cd7b60845602a28399cb5
• https://git.kernel.org/stable/c/585a0b2b3ae7903c6abee3087d09c69e955a7794
• https://git.kernel.org/stable/c/5fcf75a8a4c3e7ee9122d143684083c9faf20452
• https://git.kernel.org/stable/c/703c13fe3c9af557d312f5895ed6a5fda2711104
• https://git.kernel.org/stable/c/adc96d30f6503d30dc68670c013716f1d9fcc747
• https://git.kernel.org/stable/c/e2ea55564229e4bea1474af15b111b3a3043b76f

Get alerted when CVE-2022-48879 or the next vulnerability affects your stack