CVE-2022-49688: afs: Fix dynamic root getattr

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-26 · updated 2026-06-17
Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: afs: Fix dynamic root getattr The recent patch to make afs_getattr consult the server didn't account for the pseudo-inodes employed by the dynamic root-type afs superblock not having a volume or a server to access, and thus an oops occurs if such a directory is stat'd. Fix this by checking to see if the vnode->volume pointer actually points anywhere before following it in afs_getattr(). This can be tested by stat'ing a directory in /afs. It may be sufficient just to do "ls /afs" and the oops looks something like: BUG: kernel NULL pointer dereference, address: 0000000000000020 ... RIP: 0010:afs_getattr+0x8b/0x14b ... Call Trace: <TASK> vfs_statx+0x79/0xf5 vfs_fstatat+0x49/0x62

Affected products

Linux kernel: from 4.19.245 before 4.19.250; from 5.4.196 before 5.4.202; from 5.10.118 before 5.10.127; from 5.15.42 before 5.15.51; from 5.17.10 before 5.18; from 5.18.1 before 5.18.8 — fixed in 4.19.250, 5.10.127, 5.15.51, 5.18, 5.18.8, 5.4.202

How to fix

Upgrade to a fixed version: Linux kernel 4.19.250, 5.10.127, 5.15.51, 5.18. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-49688 or the next vulnerability affects your stack