CVE-2022-49010

What it actually does

NULL pointer dereference in hwmon coretemp driver during sysfs_remove_group() when core_data entry is already NULL and freed after error in coretemp_add_core() on CPU offline events, resulting in kernel oops and crash.

Why it matters to the business

System instability and denial of service on affected Linux kernels during CPU hotplug or offline operations, leading to unplanned reboots and service interruptions; low exploitation likelihood with stable EPSS and no KEV listing reduces urgency despite widespread Linux use.

How an attack unfolds

An attacker with local access triggers CPU offline events or coretemp initialization errors after a failed core addition, passing a freed NULL pointer to sysfs_remove_group() and causing kernel NULL dereference; listed threat actors in 2024 campaigns and Linux kernel resource issues provide context but no confirmed active use of this flaw.

How to fix it

Update to Linux kernel versions containing the fix for coretemp NULL check before sysfs removal; no messagepack-csharp fixes apply as this is a kernel hwmon issue.

How to confirm the fix worked

Verify kernel source contains the null check in coretemp_cpu_offline() before sysfs_remove_group(); test by simulating core addition error followed by CPU offline and confirm no crash or duplicate filename errors in logs.

Typical attack path

1. Gain local access to Linux system with coretemp driver loaded
2. Trigger error path in coretemp_add_core() leaving core_data NULL and freed
3. Initiate CPU offline event via cpuhp or hotplug
4. Invoke coretemp_cpu_offline() which calls sysfs_remove_group() on NULL
5. Trigger kernel NULL pointer dereference and crash

How to detect it

Search kernel logs for oops involving sysfs_remove_group and coretemp_cpu_offline, duplicate sysfs filename errors for temp*_label under coretemp, and CPU offline callbacks; correlate with threat actor activity around Linux kernel resource vulnerabilities.

• sysfs: cannot create duplicate filename '/devices/platform/coretemp
• BUG: kernel NULL pointer dereference
• coretemp_cpu_offline
• RIP: sysfs_remove_group

What your security team should do

• Prioritize kernel updates on systems using coretemp hwmon module
• Monitor for related CPU hotplug stability issues in production
• Review logs for sysfs duplicate filename or NULL dereference oops as indicators of exposure