CVE-2022-49264

CVE-2022-49264 addresses a vulnerability in the Linux kernel related to how the execve(2) system call handles an empty argument vector (argv). Specifically, the kernel previously allowed an argc (argument count) of zero, which is not recommended by POSIX and has been shown to be exploitable in scenarios like CVE-2021-4034. The fix forces a single empty string into argv when it is initially empty, setting argc to one, and warns about this behavior. The vulnerability has a CVSS score of 5.5 (Medium), indicating a local attack vector with low attack complexity, requiring low privileges, and resulting in high availability impact (denial of service) but no impact on confidentiality or integrity. The CWE is CWE-476 (NULL Pointer Dereference). There is no evidence of active exploitation, nor are there known public exploit codes in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered significant public attention.