Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L H L N U N N H 4.7 .0023 14.5 —
AFFECTED Product Versions Fixed Linux 4d57856a21ed2abe33412e0526cc84bdcf67ea08 – — Linux 4.12 – 5.4.188
TIMELINE Feb 26 Reserved by Linux Feb 26 Published (CNA: Linux) Aug 13 ENRICHED — CVE-2022-49286 (Linux). Received CVSS 4.7 and CPE data from NVD.
In the Linux kernel, the following vulnerability has been resolved: tpm: use try_get_ops() in tpm-space.c As part of the series conversion to remove nested TPM operations: https://lore.kernel.org/all/20190205224723.19671-1-jarkko.sakkinen@linux.intel.com/ exposure of the chip->tpm_mutex was removed from much of the upper level code. In this conversion, tpm2_del_space() was missed. This didn't matter much because it's usually called closely after a converted operation, so there's only a very tiny race window where the chip can be removed before the space flushing is done which causes a NULL deref on the mutex. However, there are reports of this window being hit in practice, so fix this by converting tpm2_del_space() to use tpm_try_get_ops(), which performs all the teardown checks before acquring the mutex.
| Date | Event | Detail |
|---|---|---|
| February 26, 2025 | Reserved | Reserved by Linux |
| February 26, 2025 | Published | Published (CNA: Linux) |
| August 13, 2026 | ENRICHED | ENRICHED — CVE-2022-49286 (Linux). Received CVSS 4.7 and CPE data from NVD. |
Authoritative record: CVE-2022-49286 at cve.org
Vendors: linux
Weaknesses: CWE-476
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2022-49286 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.