CVE-2022-48942

What it actually does

Unhandled -ENODEV return from devm_thermal_zone_of_sensor_register in hwmon causes hwmon_notify_event to pass a NULL or error pointer into thermal_zone_device_update, resulting in a NULL pointer dereference during mutex_lock and kernel panic.

Why it matters to the business

Systems using affected Linux kernels or Android SoCs may experience unexpected kernel crashes and reboots when a thermal zone registration fails, leading to downtime and potential data loss on servers, embedded devices, and mobile hardware.

How an attack unfolds

An attacker with local access triggers a sensor registration path that returns -ENODEV; the hwmon core fails to check the error, later invoking hwmon_thermal_notify which calls into the thermal subsystem with an invalid pointer, causing the NULL dereference crash.

How to fix it

Update to a fixed kernel containing commit 962b2a3188bfa5388756ffbc47dfa5ff59cb8011 or later; for affected Android platform/hardware/qcom/audio components, apply SoCVersion dated 2022-01-05 or newer.

How to confirm the fix worked

Verify the running kernel contains commit 962b2a3188bfa5388756ffbc47dfa5ff59cb8011; confirm hwmon devices still register successfully after thermal zone failures without triggering Oops or NULL dereference panics.

Typical attack path

1. Obtain local code execution or user privileges on an affected system
2. Trigger hardware monitoring sensor registration that encounters a thermal zone registration failure
3. Cause hwmon_notify_event to be invoked with the unhandled error pointer
4. Force thermal_zone_device_update to dereference the invalid pointer and panic the kernel

How to detect it

Search kernel logs and crash dumps for Oops messages containing mutex_lock, hwmon_notify_event, thermal_zone_device_update, and NULL pointer dereference at addresses near 0x3cd; correlate with hwmon device registration failures returning -ENODEV.

What your security team should do

• Prioritize kernel updates on all affected Linux distributions and Android devices within normal patch cycles
• Monitor for kernel panics referencing hwmon_notify_event or thermal_zone_device_update in crash logs
• Test sensor registration error paths in hardware monitoring drivers after applying fixes