{"cve":"CVE-2022-49960","nvd":{"published":"2025-06-18T11:15:23.237","modified":"2026-06-17T05:19:37.690","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: fix null pointer dereference\n\nAsus chromebook CX550 crashes during boot on v5.17-rc1 kernel.\nThe root cause is null pointer defeference of bi_next\nin tgl_get_bw_info() in drivers/gpu/drm/i915/display/intel_bw.c.\n\nBUG: kernel NULL pointer dereference, address: 000000000000002e\nPGD 0 P4D 0\nOops: 0002 [#1] PREEMPT SMP NOPTI\nCPU: 0 PID: 1 Comm: swapper/0 Tainted: G     U            5.17.0-rc1\nHardware name: Google Delbin/Delbin, BIOS Google_Delbin.13672.156.3 05/14/2021\nRIP: 0010:tgl_get_bw_info+0x2de/0x510\n...\n[    2.554467] Call Trace:\n[    2.554467]  <TASK>\n[    2.554467]  intel_bw_init_hw+0x14a/0x434\n[    2.554467]  ? _printk+0x59/0x73\n[    2.554467]  ? _dev_err+0x77/0x91\n[    2.554467]  i915_driver_hw_probe+0x329/0x33e\n[    2.554467]  i915_driver_probe+0x4c8/0x638\n[    2.554467]  i915_pci_probe+0xf8/0x14e\n[    2.554467]  ? _raw_spin_unlock_irqrestore+0x12/0x2c\n[    2.554467]  pci_device_probe+0xaa/0x142\n[    2.554467]  really_probe+0x13f/0x2f4\n[    2.554467]  __driver_probe_device+0x9e/0xd3\n[    2.554467]  driver_probe_device+0x24/0x7c\n[    2.554467]  __driver_attach+0xba/0xcf\n[    2.554467]  ? driver_attach+0x1f/0x1f\n[    2.554467]  bus_for_each_dev+0x8c/0xc0\n[    2.554467]  bus_add_driver+0x11b/0x1f7\n[    2.554467]  driver_register+0x60/0xea\n[    2.554467]  ? mipi_dsi_bus_init+0x16/0x16\n[    2.554467]  i915_init+0x2c/0xb9\n[    2.554467]  ? mipi_dsi_bus_init+0x16/0x16\n[    2.554467]  do_one_initcall+0x12e/0x2b3\n[    2.554467]  do_initcall_level+0xd6/0xf3\n[    2.554467]  do_initcalls+0x4e/0x79\n[    2.554467]  kernel_init_freeable+0xed/0x14d\n[    2.554467]  ? rest_init+0xc1/0xc1\n[    2.554467]  kernel_init+0x1a/0x120\n[    2.554467]  ret_from_fork+0x1f/0x30\n[    2.554467]  </TASK>\n...\nKernel panic - not syncing: Fatal exception\n\n(cherry picked from commit c247cd03898c4c43c3bce6d4014730403bc13032)","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":["CWE-476"],"references":["https://git.kernel.org/stable/c/458ec0c8f35963626ccd51c3d50b752de5f1b9d4","https://git.kernel.org/stable/c/c2798203315f4729bab0b917bf4c17a159abf9f8"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:03:23.287444849+00:00"},"epss":{"cve":"CVE-2022-49960","score":0.00163,"percentile":0.05536,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}