CVE-2022-49940

A flaw was found in the Linux kernel's n_gsm driver. This flaw allows a local user to cause a denial of service (DoS) by crashing the system. By triggering the receive buffer routine before multiplexer initialization, the driver attempts to access an uninitialized function pointer, resulting in a null pointer dereference.

This vulnerability is rated Moderate rather than Important because exploitation is restricted to a local denial of service without compromising system confidentiality or integrity. Triggering this flaw requires an authenticated local attacker with permissions to manipulate terminal line disciplines via ioctl calls on an unconfigured modem interface, leading to an unhandled kernel null pointer dereference. Under default Red Hat Enterprise Linux installations, the affected GSM line discipline module is not loaded, substantially limiting exposure in standard enterprise environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.