What’s Vulnerable › Vulnerabilities

CVE-2022-49273: rtc: pl031: fix rtc features null pointer dereference

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-26 · updated 2026-06-17
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: rtc: pl031: fix rtc features null pointer dereference When there is no interrupt line, rtc alarm feature is disabled. The clearing of the alarm feature bit was being done prior to allocations of ldata->rtc device, resulting in a null pointer dereference. Clear RTC_FEATURE_ALARM after the rtc device is allocated.

Affected products

• Linux kernel: from 5.12 before 5.15.33; from 5.16 before 5.16.19; from 5.17 before 5.17.2 — fixed in 5.15.33, 5.16.19, 5.17.2

How to fix

Upgrade to a fixed version: Linux kernel 5.15.33, 5.16.19, 5.17.2. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/1b915703964f7e636961df04c540261dc55c6c70
• https://git.kernel.org/stable/c/cd2722e411e8ab7e5ae41102f6925fa13dffdac5
• https://git.kernel.org/stable/c/d274ce4a3dfd0b9a292667535578359b865765cb
• https://git.kernel.org/stable/c/ea6af39f3da50c86367a71eb3cc674ade3ed244c

Get alerted when CVE-2022-49273 or the next vulnerability affects your stack