CVE-2022-50875

kernel: of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop()

Loading…

Severity

Low

Red Hat Product Security

4.7

CVSS 3.1

Review impact separately from score.

Published · December 30, 2025

Updated · June 30, 2026

Description

A NULL pointer dereference was found in the Device Tree overlay code. When memory allocation fails in kasprintf(), the resulting NULL pointer is passed to strcmp() without validation, causing a kernel crash.

Statement

Triggering this requires memory pressure sufficient to cause kmalloc() failures during device tree overlay operations. This is a low-probability scenario in normal system operation and primarily affects embedded systems using DT overlays.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 4.7
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476 · NULL Pointer Dereference