CVE-2022-49948

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2022-49948", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-06-18T10:57:27.382Z", "datePublished": "2025-06-18T11:00:12.364Z", "dateUpdated": "2026-10-15T21:31:17.598Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:56:50.380Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvt: Clear selection before changing the font\n\nWhen changing the console font with ioctl(KDFONTOP) the new font size\ncan be bigger than the previous font. A previous selection may thus now\nbe outside of the new screen size and thus trigger out-of-bounds\naccesses to graphics memory if the selection is removed in\nvc_do_resize().\n\nPrevent such out-of-memory accesses by dropping the selection before the\nvarious con_font_set() console handlers are called."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires local ioctl access to a virtual terminal device (KDFONTOP and TIOCLINUX), not network or adjacent-network reachability.\nAC:L - The attacker fully controls both prerequisites\u2014setting a console selection and changing the font to a larger size\u2014so the out-of-bounds write in imageblit can be triggered reliably without depending on external conditions.\nPR:L - KDFONTOP SET and TIOCL_SETSEL are permitted to the unprivileged owner of the controlling VT (current->signal->tty == tty); CAP_SYS_TTY_CONFIG/CAP_SYS_ADMIN are not required, matching other VT/fbcon scores.\nUI:N - The attacker performs the ioctls directly on their own VT session; no separate victim action is required.\nS:U - Impact is confined to the host kernel authority (memory corruption / DoS); there is no VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - The bug is a confirmed out-of-bounds write (stack and vmalloc) via imageblit; per kernel CVSS guidance, such memory corruption can be leveraged for arbitrary disclosure primitives.\nI:H - Out-of-bounds writes past the framebuffer and into stack/adjacent memory enable corruption exploitable for control-flow hijacking, consistent with similar fast_imageblit/fbcon OOB-write CVEs.\nA:H - Triggering the path causes kernel KASAN reports and oopses (vmalloc/stack out-of-bounds in imageblit), which is a High availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/tty/vt/vt.c"], "versions": [{"version": "009e39ae44f4191188aeb6dfbf661b771dbbe515", "lessThan": "c555cf04684fde39b5b0dd9fd80730030ee10c4a", "status": "affected", "versionType": "git"}, {"version": "009e39ae44f4191188aeb6dfbf661b771dbbe515", "lessThan": "e9ba4611ddf676194385506222cce7b0844e708e", "status": "affected", "versionType": "git"}, {"version": "009e39ae44f4191188aeb6dfbf661b771dbbe515", "lessThan": "f74b4a41c5d7c9522469917e3072e55d435efd9e", "status": "affected", "versionType": "git"}, {"version": "009e39ae44f4191188aeb6dfbf661b771dbbe515", "lessThan": "1cf1930369c9dc428d827b60260c53271bff3285", "status": "affected", "versionType": "git"}, {"version": "009e39ae44f4191188aeb6dfbf661b771dbbe515", "lessThan": "989201bb8c00b222235aff04e6200230d29dc7bb", "status": "affected", "versionType": "git"}, {"version": "009e39ae44f4191188aeb6dfbf661b771dbbe515", "lessThan": "2535431ae967ad17585513649625fea7db28d4db", "status": "affected", "versionType": "git"}, {"version": "009e39ae44f4191188aeb6dfbf661b771dbbe515", "lessThan": "c904fe03c4bd1f356a58797d39e2a5d0ca15cefc", "status": "affected", "versionType": "git"}, {"version": "009e39ae44f4191188aeb6dfbf661b771dbbe515", "lessThan": "566f9c9f89337792070b5a6062dff448b3e7977f", "status": "affected", "versionType": "git"}, {"version": "e60f8fcce05042e8f8cea25ee81fecc1222114cf", "status": "affected", "versionType": "git"}, {"version": "5812a9bc9d68a82c2cc839f88e6f7a05093ab39d", "status": "affected", "versionType": "git"}, {"version": "863ad19fd654c485e3beec3575c4d74a1e74369e", "status": "affected", "versionType": "git"}, {"version": "dbc3fd44f957a39407e889287bf61fa0ef3ecc14", "status": "affected", "versionType": "git"}, {"version": "0b2a0a58ad22f9d6dfc641bc5ec46057493f22a5", "status": "affected", "versionType": "git"}, {"version": "9f2d48f0745f921040df91bfe8fa7f0339cd7497", "status": "affected", "versionType": "git"}, {"version": "3425e397fb23cc2e8e6fb8f5b8226dcb447e84dd", "status": "affected", "versionType": "git"}, {"version": "eeae0a12a16650ff494d5faefa371cd9e7079575", "status": "affected", "versionType": "git"}, {"version": "3.2.85", "lessThan": "3.3", "status": "affected", "versionType": "semver"}, {"version": "3.10.105", "lessThan": "3.11", "status": "affected", "versionType": "semver"}, {"version": "3.12.68", "lessThan": "3.13", "status": "affected", "versionType": "semver"}, {"version": "3.16.40", "lessThan": "3.17", "status": "affected", "versionType": "semver"}, {"version": "3.18.45", "lessThan": "3.19", "status": "affected", "versionType": "semver"}, {"version": "4.1.36", "lessThan": "4.2", "status": "affected", "versionType": "semver"}, {"version": "4.4.31", "lessThan": "4.5", "status": "affected", "versionType": "semver"}, {"version": "4.8.7", "lessThan": "4.9", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/tty/vt/vt.c"], "versions": [{"version": "4.9", "status": "affected"}, {"version": "0", "lessThan": "4.9", "status": "unaffected", "versionType": "semver"}, {"version": "4.9.328", "lessThanOrEqual": "4.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.14.293", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.258", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.213", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.142", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.66", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.19.8", "lessThanOrEqual": "5.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "4.9.328"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "4.14.293"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "4.19.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.4.213"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.10.142"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.15.66"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.19.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2.85"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10.105"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12.68"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1.36"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4.31"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8.7"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c555cf04684fde39b5b0dd9fd80730030ee10c4a"}, {"url": "https://git.kernel.org/stable/c/e9ba4611ddf676194385506222cce7b0844e708e"}, {"url": "https://git.kernel.org/stable/c/f74b4a41c5d7c9522469917e3072e55d435efd9e"}, {"url": "https://git.kernel.org/stable/c/1cf1930369c9dc428d827b60260c53271bff3285"}, {"url": "https://git.kernel.org/stable/c/989201bb8c00b222235aff04e6200230d29dc7bb"}, {"url": "https://git.kernel.org/stable/c/2535431ae967ad17585513649625fea7db28d4db"}, {"url": "https://git.kernel.org/stable/c/c904fe03c4bd1f356a58797d39e2a5d0ca15cefc"}, {"url": "https://git.kernel.org/stable/c/566f9c9f89337792070b5a6062dff448b3e7977f"}], "title": "vt: Clear selection before changing the font", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-49948", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:29:48.514469Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:31:17.598Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-49948", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:29:48.514469Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:29:49.359Z"}}], "cna": {"title": "vt: Clear selection before changing the font", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires local ioctl access to a virtual terminal device (KDFONTOP and TIOCLINUX), not network or adjacent-network reachability.\nAC:L - The attacker fully controls both prerequisites\u2014setting a console selection and changing the font to a larger size\u2014so the out-of-bounds write in imageblit can be triggered reliably without depending on external conditions.\nPR:L - KDFONTOP SET and TIOCL_SETSEL are permitted to the unprivileged owner of the controlling VT (current->signal->tty == tty); CAP_SYS_TTY_CONFIG/CAP_SYS_ADMIN are not required, matching other VT/fbcon scores.\nUI:N - The attacker performs the ioctls directly on their own VT session; no separate victim action is required.\nS:U - Impact is confined to the host kernel authority (memory corruption / DoS); there is no VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - The bug is a confirmed out-of-bounds write (stack and vmalloc) via imageblit; per kernel CVSS guidance, such memory corruption can be leveraged for arbitrary disclosure primitives.\nI:H - Out-of-bounds writes past the framebuffer and into stack/adjacent memory enable corruption exploitable for control-flow hijacking, consistent with similar fast_imageblit/fbcon OOB-write CVEs.\nA:H - Triggering the path causes kernel KASAN reports and oopses (vmalloc/stack out-of-bounds in imageblit), which is a High availability impact."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515", "lessThan": "c555cf04684fde39b5b0dd9fd80730030ee10c4a", "versionType": "git"}, {"status": "affected", "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515", "lessThan": "e9ba4611ddf676194385506222cce7b0844e708e", "versionType": "git"}, {"status": "affected", "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515", "lessThan": "f74b4a41c5d7c9522469917e3072e55d435efd9e", "versionType": "git"}, {"status": "affected", "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515", "lessThan": "1cf1930369c9dc428d827b60260c53271bff3285", "versionType": "git"}, {"status": "affected", "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515", "lessThan": "989201bb8c00b222235aff04e6200230d29dc7bb", "versionType": "git"}, {"status": "affected", "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515", "lessThan": "2535431ae967ad17585513649625fea7db28d4db", "versionType": "git"}, {"status": "affected", "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515", "lessThan": "c904fe03c4bd1f356a58797d39e2a5d0ca15cefc", "versionType": "git"}, {"status": "affected", "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515", "lessThan": "566f9c9f89337792070b5a6062dff448b3e7977f", "versionType": "git"}, {"status": "affected", "version": "e60f8fcce05042e8f8cea25ee81fecc1222114cf", "versionType": "git"}, {"status": "affected", "version": "5812a9bc9d68a82c2cc839f88e6f7a05093ab39d", "versionType": "git"}, {"status": "affected", "version": "863ad19fd654c485e3beec3575c4d74a1e74369e", "versionType": "git"}, {"status": "affected", "version": "dbc3fd44f957a39407e889287bf61fa0ef3ecc14", "versionType": "git"}, {"status": "affected", "version": "0b2a0a58ad22f9d6dfc641bc5ec46057493f22a5", "versionType": "git"}, {"status": "affected", "version": "9f2d48f0745f921040df91bfe8fa7f0339cd7497", "versionType": "git"}, {"status": "affected", "version": "3425e397fb23cc2e8e6fb8f5b8226dcb447e84dd", "versionType": "git"}, {"status": "affected", "version": "eeae0a12a16650ff494d5faefa371cd9e7079575", "versionType": "git"}, {"status": "affected", "version": "3.2.85", "lessThan": "3.3", "versionType": "semver"}, {"status": "affected", "version": "3.10.105", "lessThan": "3.11", "versionType": "semver"}, {"status": "affected", "version": "3.12.68", "lessThan": "3.13", "versionType": "semver"}, {"status": "affected", "version": "3.16.40", "lessThan": "3.17", "versionType": "semver"}, {"status": "affected", "version": "3.18.45", "lessThan": "3.19", "versionType": "semver"}, {"status": "affected", "version": "4.1.36", "lessThan": "4.2", "versionType": "semver"}, {"status": "affected", "version": "4.4.31", "lessThan": "4.5", "versionType": "semver"}, {"status": "affected", "version": "4.8.7", "lessThan": "4.9", "versionType": "semver"}], "programFiles": ["drivers/tty/vt/vt.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"status": "unaffected", "version": "0", "lessThan": "4.9", "versionType": "semver"}, {"status": "unaffected", "version": "4.9.328", "versionType": "semver", "lessThanOrEqual": "4.9.*"}, {"status": "unaffected", "version": "4.14.293", "versionType": "semver", "lessThanOrEqual": "4.14.*"}, {"status": "unaffected", "version": "4.19.258", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.213", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.142", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.66", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "5.19.8", "versionType": "semver", "lessThanOrEqual": "5.19.*"}, {"status": "unaffected", "version": "6.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/tty/vt/vt.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/c555cf04684fde39b5b0dd9fd80730030ee10c4a"}, {"url": "https://git.kernel.org/stable/c/e9ba4611ddf676194385506222cce7b0844e708e"}, {"url": "https://git.kernel.org/stable/c/f74b4a41c5d7c9522469917e3072e55d435efd9e"}, {"url": "https://git.kernel.org/stable/c/1cf1930369c9dc428d827b60260c53271bff3285"}, {"url": "https://git.kernel.org/stable/c/989201bb8c00b222235aff04e6200230d29dc7bb"}, {"url": "https://git.kernel.org/stable/c/2535431ae967ad17585513649625fea7db28d4db"}, {"url": "https://git.kernel.org/stable/c/c904fe03c4bd1f356a58797d39e2a5d0ca15cefc"}, {"url": "https://git.kernel.org/stable/c/566f9c9f89337792070b5a6062dff448b3e7977f"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvt: Clear selection before changing the font\n\nWhen changing the console font with ioctl(KDFONTOP) the new font size\ncan be bigger than the previous font. A previous selection may thus now\nbe outside of the new screen size and thus trigger out-of-bounds\naccesses to graphics memory if the selection is removed in\nvc_do_resize().\n\nPrevent such out-of-memory accesses by dropping the selection before the\nvarious con_font_set() console handlers are called."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.9.328", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.14.293", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.258", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.213", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.142", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.66", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.19.8", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.0", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "3.2.85"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "3.10.105"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "3.12.68"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "3.16.40"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "3.18.45"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.1.36"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.4.31"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.8.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:56:50.380Z"}}}, "cveMetadata": {"cveId": "CVE-2022-49948", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:31:17.598Z", "dateReserved": "2025-06-18T10:57:27.382Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-06-18T11:00:12.364Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/tty/vt/vt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c555cf04684fde39b5b0dd9fd80730030ee10c4a", "status": "affected", "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515", "versionType": "git"}, {"lessThan": "e9ba4611ddf676194385506222cce7b0844e708e", "status": "affected", "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515", "versionType": "git"}, {"lessThan": "f74b4a41c5d7c9522469917e3072e55d435efd9e", "status": "affected", "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515", "versionType": "git"}, {"lessThan": "1cf1930369c9dc428d827b60260c53271bff3285", "status": "affected", "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515", "versionType": "git"}, {"lessThan": "989201bb8c00b222235aff04e6200230d29dc7bb", "status": "affected", "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515", "versionType": "git"}, {"lessThan": "2535431ae967ad17585513649625fea7db28d4db", "status": "affected", "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515", "versionType": "git"}, {"lessThan": "c904fe03c4bd1f356a58797d39e2a5d0ca15cefc", "status": "affected", "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515", "versionType": "git"}, {"lessThan": "566f9c9f89337792070b5a6062dff448b3e7977f", "status": "affected", "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515", "versionType": "git"}, {"status": "affected", "version": "e60f8fcce05042e8f8cea25ee81fecc1222114cf", "versionType": "git"}, {"status": "affected", "version": "5812a9bc9d68a82c2cc839f88e6f7a05093ab39d", "versionType": "git"}, {"status": "affected", "version": "863ad19fd654c485e3beec3575c4d74a1e74369e", "versionType": "git"}, {"status": "affected", "version": "dbc3fd44f957a39407e889287bf61fa0ef3ecc14", "versionType": "git"}, {"status": "affected", "version": "0b2a0a58ad22f9d6dfc641bc5ec46057493f22a5", "versionType": "git"}, {"status": "affected", "version": "9f2d48f0745f921040df91bfe8fa7f0339cd7497", "versionType": "git"}, {"status": "affected", "version": "3425e397fb23cc2e8e6fb8f5b8226dcb447e84dd", "versionType": "git"}, {"status": "affected", "version": "eeae0a12a16650ff494d5faefa371cd9e7079575", "versionType": "git"}, {"lessThan": "3.3", "status": "affected", "version": "3.2.85", "versionType": "semver"}, {"lessThan": "3.11", "status": "affected", "version": "3.10.105", "versionType": "semver"}, {"lessThan": "3.13", "status": "affected", "version": "3.12.68", "versionType": "semver"}, {"lessThan": "3.17", "status": "affected", "version": "3.16.40", "versionType": "semver"}, {"lessThan": "3.19", "status": "affected", "version": "3.18.45", "versionType": "semver"}, {"lessThan": "4.2", "status": "affected", "version": "4.1.36", "versionType": "semver"}, {"lessThan": "4.5", "status": "affected", "version": "4.4.31", "versionType": "semver"}, {"lessThan": "4.9", "status": "affected", "version": "4.8.7", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/tty/vt/vt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"lessThan": "4.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.9.*", "status": "unaffected", "version": "4.9.328", "versionType": "semver"}, {"lessThanOrEqual": "4.14.*", "status": "unaffected", "version": "4.14.293", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.258", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.213", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.142", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.66", "versionType": "semver"}, {"lessThanOrEqual": "5.19.*", "status": "unaffected", "version": "5.19.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "82C9EA22-96BE-488C-A979-0A1FBD90A0AE", "versionEndExcluding": "4.9.328", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5D9B742D-912D-4E0C-A42F-367086FDEA88", "versionEndExcluding": "4.14.293", "versionStartIncluding": "4.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "253D30F5-3734-4663-883A-288786D3B66E", "versionEndExcluding": "4.19.258", "versionStartIncluding": "4.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4C373116-9E23-44BA-A6B7-87C8BF5C3B85", "versionEndExcluding": "5.4.213", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D44AD643-5591-432E-BD41-C2C737F54AC0", "versionEndExcluding": "5.10.142", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "52AE7E2B-7BE3-4B8A-89CC-AB62434899A3", "versionEndExcluding": "5.15.66", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7FEC7656-4CE2-424C-8830-EDB160E701C8", "versionEndExcluding": "5.19.8", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "E8BD11A3-8643-49B6-BADE-5029A0117325", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "5F0AD220-F6A9-4012-8636-155F1B841FAD", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "A46498B3-78E1-4623-AAE1-94D29A42BE4E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvt: Clear selection before changing the font\n\nWhen changing the console font with ioctl(KDFONTOP) the new font size\ncan be bigger than the previous font. A previous selection may thus now\nbe outside of the new screen size and thus trigger out-of-bounds\naccesses to graphics memory if the selection is removed in\nvc_do_resize().\n\nPrevent such out-of-memory accesses by dropping the selection before the\nvarious con_font_set() console handlers are called."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: vt: Borrar la selecci\u00f3n antes de cambiar la fuente. Al cambiar la fuente de la consola con ioctl(KDFONTOP), el nuevo tama\u00f1o de fuente puede ser mayor que el anterior. Por lo tanto, una selecci\u00f3n anterior podr\u00eda quedar fuera del nuevo tama\u00f1o de pantalla y, por lo tanto, provocar accesos fuera de los l\u00edmites a la memoria gr\u00e1fica si se elimina la selecci\u00f3n en vc_do_resize(). Para evitar estos accesos fuera de memoria, elimine la selecci\u00f3n antes de llamar a los controladores de consola con_font_set()."}], "id": "CVE-2022-49948", "lastModified": "2026-10-15T22:17:26.047", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-49948", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:29:48.514469Z", "version": "2.0.3"}}]}, "published": "2025-06-18T11:15:21.827", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1cf1930369c9dc428d827b60260c53271bff3285"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2535431ae967ad17585513649625fea7db28d4db"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/566f9c9f89337792070b5a6062dff448b3e7977f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/989201bb8c00b222235aff04e6200230d29dc7bb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c555cf04684fde39b5b0dd9fd80730030ee10c4a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c904fe03c4bd1f356a58797d39e2a5d0ca15cefc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e9ba4611ddf676194385506222cce7b0844e708e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f74b4a41c5d7c9522469917e3072e55d435efd9e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: vt: Clear selection before changing the font", "id": "2373593", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373593"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nvt: Clear selection before changing the font\nWhen changing the console font with ioctl(KDFONTOP) the new font size\ncan be bigger than the previous font. A previous selection may thus now\nbe outside of the new screen size and thus trigger out-of-bounds\naccesses to graphics memory if the selection is removed in\nvc_do_resize().\nPrevent such out-of-memory accesses by dropping the selection before the\nvarious con_font_set() console handlers are called."], "name": "CVE-2022-49948", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Under investigation", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-06-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-49948\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-49948\nhttps://lore.kernel.org/linux-cve-announce/2025061809-CVE-2022-49948-e2a9@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-06-23T08:45:29.523430+00:00", "updated": "2025-06-23T08:45:29.523533+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}