CVE-2022-49984

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report

It is possible for a malicious device to forgo submitting a Feature Report. The HID Steam driver presently makes no prevision for this and de-references the 'struct hid_report' pointer obtained from the HID devices without first checking its validity. Let's change that.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

VendorProductVersions
LinuxLinux>= c164d6abf3841ffacfdb757c10616f9cb1f67276, < c20d03b82a2e3ddbb555dad4d4f3374a9763222c; >= c164d6abf3841ffacfdb757c10616f9cb1f67276, < fa2b822d86be5b5ad54fe4fa2daca464e71ff90a; >= c164d6abf3841ffacfdb757c10616f9cb1f67276, < dc815761948ab5b8c94db6cb53c95103588f16ae; >= c164d6abf3841ffacfdb757c10616f9cb1f67276, < 989560b6d9e00d99e07bc33067fa1c770994bf4d; >= c164d6abf3841ffacfdb757c10616f9cb1f67276, < dee1e51b54794e90763e70a3c78f27ba4fa930ec; >= c164d6abf3841ffacfdb757c10616f9cb1f67276, < cd11d1a6114bd4bc6450ae59f6e110ec47362126
LinuxLinux4.18

References

Timeline

Published
Jun 18, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2022

CVE-2022-499857.1In the Linux kernel, the following vulnerability has been resolved: bpf: Don't use tnum_range on array range checking for poke descriptors CVE-2022-499865.5In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq storvsc_errCVE-2022-499875.5In the Linux kernel, the following vulnerability has been resolved: md: call __md_stop_writes in md_stop From the link [1], we can see raiCVE-2022-499895.5In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix error exit of privcmd_ioctl_dm_op() The error exit ofCVE-2022-499907.8In the Linux kernel, the following vulnerability has been resolved: s390: fix double free of GS and RI CBs on fork() failure The pointers CVE-2022-499915.5In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: avoid corrupting page->mapping in hugetlb_mcopy_atomic_pte CVE-2022-499925.5In the Linux kernel, the following vulnerability has been resolved: mm/mprotect: only reference swap pfn page if type match Yu Zhao reportCVE-2022-499935.5In the Linux kernel, the following vulnerability has been resolved: loop: Check for overflow while configuring loop The userspace can confCVE-2022-499945.5In the Linux kernel, the following vulnerability has been resolved: bootmem: remove the vmemmap pages from kmemleak in put_page_bootmem ThCVE-2022-499957.8In the Linux kernel, the following vulnerability has been resolved: writeback: avoid use-after-free after removing device When a disk is rCVE-2022-499965.5In the Linux kernel, the following vulnerability has been resolved: btrfs: fix possible memory leak in btrfs_get_dev_args_from_path() In bCVE-2022-499975.5In the Linux kernel, the following vulnerability has been resolved: net: lantiq_xrx200: restore buffer if memory allocation failed In a si
CVE-2022-49984: Medium severity, CVSS 5.5 | Vulnix