CVE intelligence and bounded remediation

CVE-2022-49851 — Linux Linux Kernel security vulnerability

High CVSS 7.1

In the Linux kernel, the following vulnerability has been resolved: riscv: fix reserved memory setup Currently, RISC-V sets up reserved memory using the "early" copy of the device tree. As a result, when trying to get a reserved memory region using of_reserved_mem_lookup(), the pointer to reserved memory regions is using the early, pre-virtual-memory address which causes a kernel panic when trying to use the buffer's name: Unable to handle kernel paging request at virtual address 00000000401c31ac Oops [#1] Modules linked in: CPU: 0 PID: 0 Comm: swapper Not tainted 6.0.0-rc1-00001-g0d9d6953d834 #1 Hardware name: Microchip PolarFire-SoC Icicle Kit (DT) epc : string+0x4a/0xea ra : vsnprintf+0x1e4/0x336 epc : ffffffff80335ea0 ra : ffffffff80338936 sp : ffffffff81203be0 gp : ffffffff812e0a98 tp : ffffffff8120de40 t0 : 0000000000000000 t1 : ffffffff81203e28 t2 : 7265736572203a46 s0 : ffffffff81203c20 s1 : ffffffff81203e28 a0 : ffffffff81203d22 a1 : 0000000000000000 a2 : ffffffff81203d08 a3 : 0000000081203d21 a4 : ffffffffffffffff a5 : 00000000401c31ac a6 : ffff0a00ffffff04 a7 : ffffffffffffffff s2 : ffffffff81203d08 s3 : ffffffff81203d00 s4 : 0000000000000008 s5 : ffffffff000000ff s6…

Severity
High
CVSS
7.1 (3.1)
Published
2025-05-01
CISA KEV
Not currently listed
Ecosystem
linux/kernel
Weaknesses
CWE-125

Affected products

  • linux / linux_kernel
  • linux / linux_kernel / 5.4

Showing 2 representative product identities from 16 source matches. Confirm exact affected versions with the linked vendor and NVD evidence.

Matched remediation archetype

Buffer bounds, memory safety, and memory corruption

This catalog composition supplies bounded fallback guidance. Explicitly reviewed curated workflows load with the complete record below.

Check exposure

  • Identify affected native-code versions, build flags, architectures, parsers, codecs, drivers, and input paths in all shipped artifacts.
  • Determine whether untrusted data reaches the affected routine and the process privilege, sandbox, and network exposure.
  • Confirm statically linked, vendored, firmware, and platform-provided copies, not only package-manager records.

Remediate safely

  • Apply the maintained upstream correction or replace the affected component, then rebuild every dependent artifact from clean inputs.
  • Adopt bounds-checked interfaces, validated sizes and integer conversions, clear ownership, and memory-safe components where practical.
  • Enable supported compiler and runtime hardening and add sanitized tests and fuzz regression seeds derived from non-weaponized fixtures.

Authoritative sources

Complete CVE record and remediation plan

The detailed catalog view below loads this exact record, its source evidence, and the full seven-phase agentic change plan.