CVE-2022-48991

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2022-48991", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-22T01:27:53.636Z", "datePublished": "2024-10-21T20:06:08.312Z", "dateUpdated": "2026-08-05T08:53:20.576Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:53:20.576Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/khugepaged: invoke MMU notifiers in shmem/file collapse paths\n\nAny codepath that zaps page table entries must invoke MMU notifiers to\nensure that secondary MMUs (like KVM) don't keep accessing pages which\naren't mapped anymore. Secondary MMUs don't hold their own references to\npages that are mirrored over, so failing to notify them can lead to page\nuse-after-free.\n\nI'm marking this as addressing an issue introduced in commit f3f0e1d2150b\n(\"khugepaged: add support of collapse for tmpfs/shmem pages\"), but most of\nthe security impact of this only came in commit 27e1f8273113 (\"khugepaged:\nenable collapse pmd for pte-mapped THP\"), which actually omitted flushes\nfor the removal of present PTEs, not just for the removal of empty page\ntables."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is triggered by local mm paths (khugepaged or madvise/MADV_COLLAPSE) that retract host page tables mirrored into KVM; exploitation requires local or guest access to that KVM secondary MMU, not network or adjacent-link input.\nAC:L - An attacker who controls shmem/file-backed guest memory can reliably force collapse (MADV_COLLAPSE or khugepaged) and keep accessing via KVM; Jann Horn demonstrated a working KVM reproducer that reads freed page contents, with no victim-only timing or layout precondition.\nPR:L - Exploitation needs only the ability to run as an unprivileged local user with KVM access or as a KVM guest; host root or init-namespace admin capabilities are not required.\nUI:N - No separate victim action is required; the attacker (or attacker-controlled guest) drives memory setup, collapse, and secondary-MMU access themselves.\nS:C - Failing to invalidate KVM\u2019s secondary MMU leaves the guest mapped to freed host pages after THP collapse, enabling guest-to-host memory access and crossing the guest/hypervisor security boundary.\nC:H - This is a page use-after-free through KVM; the public reproducer reads PAGE_POISON from freed file THP pages, and page reuse yields a host-kernel arbitrary-read primitive.\nI:H - Stale KVM SPTEs to freed pages also provide a write path once those pages are reused, enabling host memory corruption and control-flow hijacking consistent with UAF escape-class impact.\nA:H - Use-after-free through stale secondary-MMU mappings can oops/panic the host when freed or reused pages are accessed, and a malicious guest can repeat the trigger to deny service to the host and colocated guests."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/khugepaged.c"], "versions": [{"version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "lessThan": "275c626c131cfe141beeb6c575e31fa53d32da19", "status": "affected", "versionType": "git"}, {"version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "lessThan": "c23105673228c349739e958fa33955ed8faddcaf", "status": "affected", "versionType": "git"}, {"version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "lessThan": "ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3", "status": "affected", "versionType": "git"}, {"version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "lessThan": "5ffc2a75534d9d74d49760f983f8eb675fa63d69", "status": "affected", "versionType": "git"}, {"version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "lessThan": "7f445ca2e0e59c7971d0b7b853465e50844ab596", "status": "affected", "versionType": "git"}, {"version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "lessThan": "1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3", "status": "affected", "versionType": "git"}, {"version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "lessThan": "5450535901d89a5dcca5fbbc59a24fe89caeb465", "status": "affected", "versionType": "git"}, {"version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "lessThan": "f268f6cf875f3220afc77bdd0bf1bb136eb54db9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/khugepaged.c"], "versions": [{"version": "4.8", "status": "affected"}, {"version": "0", "lessThan": "4.8", "status": "unaffected", "versionType": "semver"}, {"version": "4.9.337", "lessThanOrEqual": "4.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.14.303", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.270", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.227", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.159", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.83", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.0.13", "lessThanOrEqual": "6.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "4.9.337"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "4.14.303"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "4.19.270"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.4.227"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.10.159"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.15.83"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.0.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/275c626c131cfe141beeb6c575e31fa53d32da19"}, {"url": "https://git.kernel.org/stable/c/c23105673228c349739e958fa33955ed8faddcaf"}, {"url": "https://git.kernel.org/stable/c/ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3"}, {"url": "https://git.kernel.org/stable/c/5ffc2a75534d9d74d49760f983f8eb675fa63d69"}, {"url": "https://git.kernel.org/stable/c/7f445ca2e0e59c7971d0b7b853465e50844ab596"}, {"url": "https://git.kernel.org/stable/c/1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3"}, {"url": "https://git.kernel.org/stable/c/5450535901d89a5dcca5fbbc59a24fe89caeb465"}, {"url": "https://git.kernel.org/stable/c/f268f6cf875f3220afc77bdd0bf1bb136eb54db9"}], "title": "mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48991", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-22T13:16:32.481668Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T13:18:42.186Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48991", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-22T13:16:32.481668Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T13:16:37.120Z"}}], "cna": {"title": "mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is triggered by local mm paths (khugepaged or madvise/MADV_COLLAPSE) that retract host page tables mirrored into KVM; exploitation requires local or guest access to that KVM secondary MMU, not network or adjacent-link input.\nAC:L - An attacker who controls shmem/file-backed guest memory can reliably force collapse (MADV_COLLAPSE or khugepaged) and keep accessing via KVM; Jann Horn demonstrated a working KVM reproducer that reads freed page contents, with no victim-only timing or layout precondition.\nPR:L - Exploitation needs only the ability to run as an unprivileged local user with KVM access or as a KVM guest; host root or init-namespace admin capabilities are not required.\nUI:N - No separate victim action is required; the attacker (or attacker-controlled guest) drives memory setup, collapse, and secondary-MMU access themselves.\nS:C - Failing to invalidate KVM\u2019s secondary MMU leaves the guest mapped to freed host pages after THP collapse, enabling guest-to-host memory access and crossing the guest/hypervisor security boundary.\nC:H - This is a page use-after-free through KVM; the public reproducer reads PAGE_POISON from freed file THP pages, and page reuse yields a host-kernel arbitrary-read primitive.\nI:H - Stale KVM SPTEs to freed pages also provide a write path once those pages are reused, enabling host memory corruption and control-flow hijacking consistent with UAF escape-class impact.\nA:H - Use-after-free through stale secondary-MMU mappings can oops/panic the host when freed or reused pages are accessed, and a malicious guest can repeat the trigger to deny service to the host and colocated guests."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "lessThan": "275c626c131cfe141beeb6c575e31fa53d32da19", "versionType": "git"}, {"status": "affected", "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "lessThan": "c23105673228c349739e958fa33955ed8faddcaf", "versionType": "git"}, {"status": "affected", "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "lessThan": "ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3", "versionType": "git"}, {"status": "affected", "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "lessThan": "5ffc2a75534d9d74d49760f983f8eb675fa63d69", "versionType": "git"}, {"status": "affected", "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "lessThan": "7f445ca2e0e59c7971d0b7b853465e50844ab596", "versionType": "git"}, {"status": "affected", "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "lessThan": "1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3", "versionType": "git"}, {"status": "affected", "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "lessThan": "5450535901d89a5dcca5fbbc59a24fe89caeb465", "versionType": "git"}, {"status": "affected", "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "lessThan": "f268f6cf875f3220afc77bdd0bf1bb136eb54db9", "versionType": "git"}], "programFiles": ["mm/khugepaged.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.8"}, {"status": "unaffected", "version": "0", "lessThan": "4.8", "versionType": "semver"}, {"status": "unaffected", "version": "4.9.337", "versionType": "semver", "lessThanOrEqual": "4.9.*"}, {"status": "unaffected", "version": "4.14.303", "versionType": "semver", "lessThanOrEqual": "4.14.*"}, {"status": "unaffected", "version": "4.19.270", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.227", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.159", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.83", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.0.13", "versionType": "semver", "lessThanOrEqual": "6.0.*"}, {"status": "unaffected", "version": "6.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["mm/khugepaged.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/275c626c131cfe141beeb6c575e31fa53d32da19"}, {"url": "https://git.kernel.org/stable/c/c23105673228c349739e958fa33955ed8faddcaf"}, {"url": "https://git.kernel.org/stable/c/ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3"}, {"url": "https://git.kernel.org/stable/c/5ffc2a75534d9d74d49760f983f8eb675fa63d69"}, {"url": "https://git.kernel.org/stable/c/7f445ca2e0e59c7971d0b7b853465e50844ab596"}, {"url": "https://git.kernel.org/stable/c/1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3"}, {"url": "https://git.kernel.org/stable/c/5450535901d89a5dcca5fbbc59a24fe89caeb465"}, {"url": "https://git.kernel.org/stable/c/f268f6cf875f3220afc77bdd0bf1bb136eb54db9"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/khugepaged: invoke MMU notifiers in shmem/file collapse paths\n\nAny codepath that zaps page table entries must invoke MMU notifiers to\nensure that secondary MMUs (like KVM) don't keep accessing pages which\naren't mapped anymore. Secondary MMUs don't hold their own references to\npages that are mirrored over, so failing to notify them can lead to page\nuse-after-free.\n\nI'm marking this as addressing an issue introduced in commit f3f0e1d2150b\n(\"khugepaged: add support of collapse for tmpfs/shmem pages\"), but most of\nthe security impact of this only came in commit 27e1f8273113 (\"khugepaged:\nenable collapse pmd for pte-mapped THP\"), which actually omitted flushes\nfor the removal of present PTEs, not just for the removal of empty page\ntables."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.9.337", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.14.303", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.270", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.227", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.159", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.83", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.0.13", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1", "versionStartIncluding": "4.8"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:53:20.576Z"}}}, "cveMetadata": {"cveId": "CVE-2022-48991", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:53:20.576Z", "dateReserved": "2024-08-22T01:27:53.636Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-10-21T20:06:08.312Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["mm/khugepaged.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "275c626c131cfe141beeb6c575e31fa53d32da19", "status": "affected", "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "versionType": "git"}, {"lessThan": "c23105673228c349739e958fa33955ed8faddcaf", "status": "affected", "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "versionType": "git"}, {"lessThan": "ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3", "status": "affected", "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "versionType": "git"}, {"lessThan": "5ffc2a75534d9d74d49760f983f8eb675fa63d69", "status": "affected", "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "versionType": "git"}, {"lessThan": "7f445ca2e0e59c7971d0b7b853465e50844ab596", "status": "affected", "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "versionType": "git"}, {"lessThan": "1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3", "status": "affected", "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "versionType": "git"}, {"lessThan": "5450535901d89a5dcca5fbbc59a24fe89caeb465", "status": "affected", "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "versionType": "git"}, {"lessThan": "f268f6cf875f3220afc77bdd0bf1bb136eb54db9", "status": "affected", "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["mm/khugepaged.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.8"}, {"lessThan": "4.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.9.*", "status": "unaffected", "version": "4.9.337", "versionType": "semver"}, {"lessThanOrEqual": "4.14.*", "status": "unaffected", "version": "4.14.303", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.270", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.227", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.159", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.83", "versionType": "semver"}, {"lessThanOrEqual": "6.0.*", "status": "unaffected", "version": "6.0.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3A7C6654-B729-4CE8-922E-B5675245AF0A", "versionEndExcluding": "4.9.337", "versionStartIncluding": "4.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1E7450AD-4739-46F0-B81B-C02E7B35A97B", "versionEndExcluding": "4.14.303", "versionStartIncluding": "4.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AE8904A3-99BE-4E49-9682-1F90A6373F4F", "versionEndExcluding": "4.19.270", "versionStartIncluding": "4.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8C752145-904B-474A-A7F2-E9F29353B0FE", "versionEndExcluding": "5.4.227", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7318B597-DFFD-4BBC-A947-539D6E30D82A", "versionEndExcluding": "5.10.159", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "90897BD1-104D-4CFF-94F5-29F9041217FB", "versionEndExcluding": "5.15.83", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "389392A7-81C4-4C26-884B-8C7CF0F53DA4", "versionEndExcluding": "6.0.13", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "E7E331DA-1FB0-4DEC-91AC-7DA69D461C11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "17F0B248-42CF-4AE6-A469-BB1BAE7F4705", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "E2422816-0C14-4B5E-A1E6-A9D776E5C49B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "35B26BE4-43A6-4A36-A7F6-5B3F572D9186", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*", "matchCriteriaId": "3FFFB0B3-930D-408A-91E2-BAE0C2715D80", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*", "matchCriteriaId": "8535320E-A0DB-4277-800E-D0CE5BBA59E8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/khugepaged: invoke MMU notifiers in shmem/file collapse paths\n\nAny codepath that zaps page table entries must invoke MMU notifiers to\nensure that secondary MMUs (like KVM) don't keep accessing pages which\naren't mapped anymore. Secondary MMUs don't hold their own references to\npages that are mirrored over, so failing to notify them can lead to page\nuse-after-free.\n\nI'm marking this as addressing an issue introduced in commit f3f0e1d2150b\n(\"khugepaged: add support of collapse for tmpfs/shmem pages\"), but most of\nthe security impact of this only came in commit 27e1f8273113 (\"khugepaged:\nenable collapse pmd for pte-mapped THP\"), which actually omitted flushes\nfor the removal of present PTEs, not just for the removal of empty page\ntables."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/khugepaged: invocar notificadores MMU en rutas de colapso de shmem/archivo Cualquier ruta de c\u00f3digo que elimine las entradas de la tabla de p\u00e1ginas debe invocar notificadores MMU para garantizar que las MMU secundarias (como KVM) no sigan accediendo a p\u00e1ginas que ya no est\u00e1n asignadas. Las MMU secundarias no mantienen sus propias referencias a p\u00e1ginas que se reflejan, por lo que no notificarlas puede provocar el use-after-free de la p\u00e1gina. Estoy marcando esto como una soluci\u00f3n a un problema introducido en el commit f3f0e1d2150b (\"khugepaged: agregar compatibilidad con el colapso para p\u00e1ginas tmpfs/shmem\"), pero la mayor parte del impacto de seguridad de esto solo se produjo en el commit 27e1f8273113 (\"khugepaged: habilitar el colapso pmd para THP asignado a pte\"), que en realidad omiti\u00f3 los vaciados para la eliminaci\u00f3n de PTE actuales, no solo para la eliminaci\u00f3n de tablas de p\u00e1ginas vac\u00edas."}], "id": "CVE-2022-48991", "lastModified": "2026-08-04T10:17:30.070", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-48991", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-10-22T13:16:32.481668Z", "version": "2.0.3"}}]}, "published": "2024-10-21T20:15:11.000", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/275c626c131cfe141beeb6c575e31fa53d32da19"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5450535901d89a5dcca5fbbc59a24fe89caeb465"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5ffc2a75534d9d74d49760f983f8eb675fa63d69"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7f445ca2e0e59c7971d0b7b853465e50844ab596"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c23105673228c349739e958fa33955ed8faddcaf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f268f6cf875f3220afc77bdd0bf1bb136eb54db9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2023:6583", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-362.8.1.el9_3", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-11-07T00:00:00Z"}, {"advisory": "RHSA-2023:6583", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-362.8.1.el9_3", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-11-07T00:00:00Z"}], "bugzilla": {"description": "kernel: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths", "id": "2320713", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2320713"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmm/khugepaged: invoke MMU notifiers in shmem/file collapse paths\nAny codepath that zaps page table entries must invoke MMU notifiers to\nensure that secondary MMUs (like KVM) don't keep accessing pages which\naren't mapped anymore. Secondary MMUs don't hold their own references to\npages that are mirrored over, so failing to notify them can lead to page\nuse-after-free.\nI'm marking this as addressing an issue introduced in commit f3f0e1d2150b\n(\"khugepaged: add support of collapse for tmpfs/shmem pages\"), but most of\nthe security impact of this only came in commit 27e1f8273113 (\"khugepaged:\nenable collapse pmd for pte-mapped THP\"), which actually omitted flushes\nfor the removal of present PTEs, not just for the removal of empty page\ntables."], "name": "CVE-2022-48991", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-10-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-48991\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-48991\nhttps://lore.kernel.org/linux-cve-announce/2024102148-CVE-2022-48991-3987@gregkh/T"], "statement": "This issue is considered to be a moderate impact flaw, as the reproduction (and exploit) for this is complex and not available.", "threat_severity": "Moderate"}

{}