CVE-2022-49059 – This is a use-after-free vulnerability in the L... (How to Fix)

Q: What is the severity of CVE-2022-49059?

CVE-2022-49059 has a CVSS score of 7.8 (HIGH). This is a use-after-free vulnerability in the Linux kernel's NFC (Near Field Communication) subsystem that can lead to kernel crashes or potential code execution. It affects Linux systems with NFC functionality enabled, particularly when NFC devices are being detached. The race condition occurs between timer cleanup and workqueue operations during device unregistration.

📋 TL;DR

This is a use-after-free vulnerability in the Linux kernel's NFC (Near Field Communication) subsystem that can lead to kernel crashes or potential code execution. It affects Linux systems with NFC functionality enabled, particularly when NFC devices are being detached. The race condition occurs between timer cleanup and workqueue operations during device unregistration.

💻 Affected Systems

Products:

Linux Kernel

Versions: Kernel versions before the fix commits (specific versions vary by distribution, but generally before kernel 5.18-rc2 fixes)

Operating Systems: Linux distributions with vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with NFC functionality enabled and NFC devices present. Many servers without NFC hardware are not vulnerable.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, or potential privilege escalation if an attacker can control the freed memory region to execute arbitrary code.

🟠

Likely Case

System crash or kernel panic when NFC devices are disconnected, causing denial of service.

🟢

If Mitigated

No impact if NFC functionality is disabled or the system is patched.

🌐 Internet-Facing: LOW - This requires local access or NFC device interaction, not directly exploitable over network.

🏢 Internal Only: MEDIUM - Local users or processes interacting with NFC devices could trigger the crash, affecting system stability.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

The description includes a proof-of-concept crash trace. Exploitation requires timing precision to trigger the race condition and local access to NFC devices.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions with commits: 1a1748d0dd0f0a98535c6baeef671c8722107639, 5c63ad2b0a267a524c12c88acb1ba9c2d109a801, 67677050cecbe0edfdd81cd508415e9636ba7c65, 7d3232214ca4ea8f7d18df264c3b254aa8089d7f, 9d243aff5f7e6b04e907c617426bbdf26e996ac8

Vendor Advisory: https://git.kernel.org/stable/c/1a1748d0dd0f0a98535c6baeef671c8722107639

Restart Required: Yes

Instructions:

1. Update Linux kernel to a patched version from your distribution. 2. For custom kernels, apply the fix commits from kernel.org. 3. Reboot the system after kernel update.

🔧 Temporary Workarounds

Disable NFC functionality

Linux

Remove or disable NFC kernel modules to prevent the vulnerable code from being executed.

modprobe -r nfc
echo 'blacklist nfc' >> /etc/modprobe.d/blacklist.conf

🧯 If You Can't Patch

Disable all NFC devices and modules if not required
Restrict physical access to NFC hardware and limit user privileges for NFC operations

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if NFC modules are loaded: uname -r && lsmod | grep -i nfc

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is after the fix commits and test NFC device detachment without crashes.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages mentioning KASAN use-after-free in enqueue_timer
Crash logs referencing nci_cmd_work or NFC subsystem

Network Indicators:

None - this is a local kernel vulnerability

SIEM Query:

source="kernel" AND ("KASAN: use-after-free" OR "nci_cmd_work" OR "NFC crash")

📊 Metadata

CVE ID: CVE-2022-49059

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.02% exploit probability (4.8th percentile)

Published: February 26, 2025

Last Updated: March 24, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-49059, you might also want to check these: