What’s Vulnerable › Vulnerabilities

CVE-2022-49145: ACPI: CPPC: Avoid out of bounds access when parsing _CPC data

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-26 · updated 2026-06-17
• Weakness: CWE-125

Description

In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Avoid out of bounds access when parsing _CPC data If the NumEntries field in the _CPC return package is less than 2, do not attempt to access the "Revision" element of that package, because it may not be present then. BugLink: https://lore.kernel.org/lkml/20220322143534.GC32582@xsang-OptiPlex-9020/

Affected products

• Linux kernel: from 4.4 before 4.9.311; from 4.10 before 4.14.276; from 4.15 before 4.19.238; from 4.20 before 5.4.189; from 5.5 before 5.10.110; from 5.11 before 5.15.33 — fixed in 4.14.276, 4.19.238, 4.9.311, 5.10.110, 5.15.33, 5.16.19

How to fix

Upgrade to a fixed version: Linux kernel 4.14.276, 4.19.238, 4.9.311, 5.10.110. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/28d5387c1994f5e1e0d41b30a1f3dd6e1f609252
• https://git.kernel.org/stable/c/40d8abf364bcab23bc715a9221a3c8623956257b
• https://git.kernel.org/stable/c/97b5593fd1b182b3fdb180b6bbe64ec09669988b
• https://git.kernel.org/stable/c/b3f15609ffa521de12244cd6af24002030dda3f5
• https://git.kernel.org/stable/c/b80b19b32a432c9eee1cd200ef7aaddf608f54d1
• https://git.kernel.org/stable/c/cb249f8c00f40dba83b7da8207ac14ca46e9ec9e
• https://git.kernel.org/stable/c/d208ea44e25b31db5a4d5e8c31df51787a3e9303
• https://git.kernel.org/stable/c/d7339f2a3938fb56b5f28d53f5345900b5fa0e74
• https://git.kernel.org/stable/c/e5b681822cac1f8093759b02e16c06b2c64b6788

Get alerted when CVE-2022-49145 or the next vulnerability affects your stack