GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-48986 (GCVE-0-2022-48986)

Vulnerability from cvelistv5 – Published: 2024-10-21 20:06 – Updated: 2026-08-05 08:53
VLAI
Title
mm/gup: fix gup_pud_range() for dax
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix gup_pud_range() for dax For dax pud, pud_huge() returns true on x86. So the function works as long as hugetlb is configured. However, dax doesn't depend on hugetlb. Commit 414fd080d125 ("mm/gup: fix gup_pmd_range() for dax") fixed devmap-backed huge PMDs, but missed devmap-backed huge PUDs. Fix this as well. This fixes the below kernel panic: general protection fault, probably for non-canonical address 0x69e7c000cc478: 0000 [#1] SMP < snip > Call Trace: <TASK> get_user_pages_fast+0x1f/0x40 iov_iter_get_pages+0xc6/0x3b0 ? mempool_alloc+0x5d/0x170 bio_iov_iter_get_pages+0x82/0x4e0 ? bvec_alloc+0x91/0xc0 ? bio_alloc_bioset+0x19a/0x2a0 blkdev_direct_IO+0x282/0x480 ? __io_complete_rw_common+0xc0/0xc0 ? filemap_range_has_page+0x82/0xc0 generic_file_direct_write+0x9d/0x1a0 ? inode_update_time+0x24/0x30 __generic_file_write_iter+0xbd/0x1e0 blkdev_write_iter+0xb4/0x150 ? io_import_iovec+0x8d/0x340 io_write+0xf9/0x300 io_issue_sqe+0x3c3/0x1d30 ? sysvec_reschedule_ipi+0x6c/0x80 __io_queue_sqe+0x33/0x240 ? fget+0x76/0xa0 io_submit_sqes+0xe6a/0x18d0 ? __fget_light+0xd1/0x100 __x64_sys_io_uring_enter+0x199/0x880 ? __context_tracking_enter+0x1f/0x70 ? irqentry_exit_to_user_mode+0x24/0x30 ? irqentry_exit+0x1d/0x30 ? __context_tracking_exit+0xe/0x70 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fc97c11a7be < snip > </TASK> ---[ end trace 48b2e0e67debcaeb ]--- RIP: 0010:internal_get_user_pages_fast+0x340/0x990 < snip > Kernel panic - not syncing: Fatal exception Kernel Offset: disabled
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-22 13:17 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 414fd080d125408cb15d04ff4907e1dd8145c8c7 , < 04edfa3dc06ecfc6133a33bc7271298782dee875 (git)
Affected: 414fd080d125408cb15d04ff4907e1dd8145c8c7 , < f1cf856123ceb766c49967ec79b841030fa1741f (git)
Affected: 414fd080d125408cb15d04ff4907e1dd8145c8c7 , < 3ac29732a2ffa64c7de13a072b0f2848b9c11037 (git)
Affected: 414fd080d125408cb15d04ff4907e1dd8145c8c7 , < e06d13c36ded750c72521b600293befebb4e56c5 (git)
Affected: 414fd080d125408cb15d04ff4907e1dd8145c8c7 , < fcd0ccd836ffad73d98a66f6fea7b16f735ea920 (git)
Affected: c133d8eb894cb280f331608c6f1962ba9fbfe6b0 (git)
Affected: 538162d21ac877b060dc057c89f13718f5caffc5 (git)
Affected: 8b1a7762e0dac5db42a003009fdcb425f10baa07 (git)
Affected: 4.9.165 , < 4.10 (semver)
Affected: 4.14.108 , < 4.15 (semver)
Affected: 4.19.31 , < 4.20 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.0
Unaffected: 0 , < 5.0 (semver)
Unaffected: 5.4.227 , ≤ 5.4.* (semver)
Unaffected: 5.10.159 , ≤ 5.10.* (semver)
Unaffected: 5.15.83 , ≤ 5.15.* (semver)
Unaffected: 6.0.13 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48986",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:17:13.077740Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:18:42.957Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/gup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "04edfa3dc06ecfc6133a33bc7271298782dee875",
              "status": "affected",
              "version": "414fd080d125408cb15d04ff4907e1dd8145c8c7",
              "versionType": "git"
            },
            {
              "lessThan": "f1cf856123ceb766c49967ec79b841030fa1741f",
              "status": "affected",
              "version": "414fd080d125408cb15d04ff4907e1dd8145c8c7",
              "versionType": "git"
            },
            {
              "lessThan": "3ac29732a2ffa64c7de13a072b0f2848b9c11037",
              "status": "affected",
              "version": "414fd080d125408cb15d04ff4907e1dd8145c8c7",
              "versionType": "git"
            },
            {
              "lessThan": "e06d13c36ded750c72521b600293befebb4e56c5",
              "status": "affected",
              "version": "414fd080d125408cb15d04ff4907e1dd8145c8c7",
              "versionType": "git"
            },
            {
              "lessThan": "fcd0ccd836ffad73d98a66f6fea7b16f735ea920",
              "status": "affected",
              "version": "414fd080d125408cb15d04ff4907e1dd8145c8c7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c133d8eb894cb280f331608c6f1962ba9fbfe6b0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "538162d21ac877b060dc057c89f13718f5caffc5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8b1a7762e0dac5db42a003009fdcb425f10baa07",
              "versionType": "git"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.165",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.108",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.31",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/gup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.227",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.227",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.159",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.83",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.13",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.165",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.108",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.31",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/gup: fix gup_pud_range() for dax\n\nFor dax pud, pud_huge() returns true on x86. So the function works as long\nas hugetlb is configured. However, dax doesn\u0027t depend on hugetlb.\nCommit 414fd080d125 (\"mm/gup: fix gup_pmd_range() for dax\") fixed\ndevmap-backed huge PMDs, but missed devmap-backed huge PUDs. Fix this as\nwell.\n\nThis fixes the below kernel panic:\n\ngeneral protection fault, probably for non-canonical address 0x69e7c000cc478: 0000 [#1] SMP\n\t\u003c snip \u003e\nCall Trace:\n\u003cTASK\u003e\nget_user_pages_fast+0x1f/0x40\niov_iter_get_pages+0xc6/0x3b0\n? mempool_alloc+0x5d/0x170\nbio_iov_iter_get_pages+0x82/0x4e0\n? bvec_alloc+0x91/0xc0\n? bio_alloc_bioset+0x19a/0x2a0\nblkdev_direct_IO+0x282/0x480\n? __io_complete_rw_common+0xc0/0xc0\n? filemap_range_has_page+0x82/0xc0\ngeneric_file_direct_write+0x9d/0x1a0\n? inode_update_time+0x24/0x30\n__generic_file_write_iter+0xbd/0x1e0\nblkdev_write_iter+0xb4/0x150\n? io_import_iovec+0x8d/0x340\nio_write+0xf9/0x300\nio_issue_sqe+0x3c3/0x1d30\n? sysvec_reschedule_ipi+0x6c/0x80\n__io_queue_sqe+0x33/0x240\n? fget+0x76/0xa0\nio_submit_sqes+0xe6a/0x18d0\n? __fget_light+0xd1/0x100\n__x64_sys_io_uring_enter+0x199/0x880\n? __context_tracking_enter+0x1f/0x70\n? irqentry_exit_to_user_mode+0x24/0x30\n? irqentry_exit+0x1d/0x30\n? __context_tracking_exit+0xe/0x70\ndo_syscall_64+0x3b/0x90\nentry_SYSCALL_64_after_hwframe+0x61/0xcb\nRIP: 0033:0x7fc97c11a7be\n\t\u003c snip \u003e\n\u003c/TASK\u003e\n---[ end trace 48b2e0e67debcaeb ]---\nRIP: 0010:internal_get_user_pages_fast+0x340/0x990\n\t\u003c snip \u003e\nKernel panic - not syncing: Fatal exception\nKernel Offset: disabled"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local access to mmap a device-DAX mapping (/dev/dax with PUD alignment) and trigger get_user_pages_fast via a local syscall path such as O_DIRECT/io_uring; it is not reachable from the network stack.\nAC:L - Once a vulnerable kernel has a PUD-sized DAX mapping, the attacker fully controls the mapping contents and the GUP trigger, so the incorrect page-table walk or crash can be induced reliably without races or victim-dependent timing.\nPR:L - The DAX driver performs no capability check beyond ordinary file permissions on /dev/dax; an unprivileged user granted access to that device (common for PMEM/CXL workloads) can mmap it and trigger GUP without real root.\nUI:N - The attacker triggers the bug entirely through their own syscalls (mmap plus O_DIRECT/io_uring or other GUP users); no separate victim action is required.\nS:U - Impact is confined to the same kernel security authority (local DoS or memory access within the host kernel); this is not a VM/IOMMU escape or other cross-boundary scope change.\nC:H - When HUGETLB is disabled, gup_pud_range() treats a DAX PUD as a page-table pointer into attacker-controlled DAX memory in the linear map, so crafted PTEs can pin arbitrary valid pages that O_DIRECT write then exfiltrates to storage.\nI:H - The same confused GUP walk can pin arbitrary pages as the destination of O_DIRECT reads, yielding an arbitrary physical-memory write primitive and enabling further control-flow hijacking.\nA:H - Uncrafted or invalid walks produce a general protection fault and kernel panic in get_user_pages_fast, as shown in the fix commit\u2019s reproducer call trace."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:53:16.291Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/04edfa3dc06ecfc6133a33bc7271298782dee875"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1cf856123ceb766c49967ec79b841030fa1741f"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ac29732a2ffa64c7de13a072b0f2848b9c11037"
        },
        {
          "url": "https://git.kernel.org/stable/c/e06d13c36ded750c72521b600293befebb4e56c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/fcd0ccd836ffad73d98a66f6fea7b16f735ea920"
        }
      ],
      "title": "mm/gup: fix gup_pud_range() for dax",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48986",
    "datePublished": "2024-10-21T20:06:02.502Z",
    "dateReserved": "2024-08-22T01:27:53.634Z",
    "dateUpdated": "2026-08-05T08:53:16.291Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48986",
      "date": "2026-09-16",
      "epss": "0.00255",
      "percentile": "0.17321"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.9.165\", \"versionEndExcluding\": \"4.10\", \"matchCriteriaId\": \"03D696FD-2217-4673-A661-651833DB97FD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.14.108\", \"versionEndExcluding\": \"4.15\", \"matchCriteriaId\": \"8EA0A3D7-55DF-4AF3-90C1-D65B1FFBF3BD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.19.31\", \"versionEndExcluding\": \"4.20\", \"matchCriteriaId\": \"C208F54A-1F85-44EF-9E91-6DA461A49CA0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.0\", \"versionEndExcluding\": \"5.4.227\", \"matchCriteriaId\": \"75ADB045-951E-4837-969B-C2C77523AD98\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.5\", \"versionEndExcluding\": \"5.10.159\", \"matchCriteriaId\": \"7318B597-DFFD-4BBC-A947-539D6E30D82A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.83\", \"matchCriteriaId\": \"90897BD1-104D-4CFF-94F5-29F9041217FB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.0.13\", \"matchCriteriaId\": \"389392A7-81C4-4C26-884B-8C7CF0F53DA4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"E7E331DA-1FB0-4DEC-91AC-7DA69D461C11\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"17F0B248-42CF-4AE6-A469-BB1BAE7F4705\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"E2422816-0C14-4B5E-A1E6-A9D776E5C49B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"35B26BE4-43A6-4A36-A7F6-5B3F572D9186\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*\", \"matchCriteriaId\": \"3FFFB0B3-930D-408A-91E2-BAE0C2715D80\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*\", \"matchCriteriaId\": \"8535320E-A0DB-4277-800E-D0CE5BBA59E8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:*\", \"matchCriteriaId\": \"21718AA4-4056-40F2-968E-BDAA465A7872\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/gup: fix gup_pud_range() for dax\\n\\nFor dax pud, pud_huge() returns true on x86. So the function works as long\\nas hugetlb is configured. However, dax doesn\u0027t depend on hugetlb.\\nCommit 414fd080d125 (\\\"mm/gup: fix gup_pmd_range() for dax\\\") fixed\\ndevmap-backed huge PMDs, but missed devmap-backed huge PUDs. Fix this as\\nwell.\\n\\nThis fixes the below kernel panic:\\n\\ngeneral protection fault, probably for non-canonical address 0x69e7c000cc478: 0000 [#1] SMP\\n\\t\u003c snip \u003e\\nCall Trace:\\n\u003cTASK\u003e\\nget_user_pages_fast+0x1f/0x40\\niov_iter_get_pages+0xc6/0x3b0\\n? mempool_alloc+0x5d/0x170\\nbio_iov_iter_get_pages+0x82/0x4e0\\n? bvec_alloc+0x91/0xc0\\n? bio_alloc_bioset+0x19a/0x2a0\\nblkdev_direct_IO+0x282/0x480\\n? __io_complete_rw_common+0xc0/0xc0\\n? filemap_range_has_page+0x82/0xc0\\ngeneric_file_direct_write+0x9d/0x1a0\\n? inode_update_time+0x24/0x30\\n__generic_file_write_iter+0xbd/0x1e0\\nblkdev_write_iter+0xb4/0x150\\n? io_import_iovec+0x8d/0x340\\nio_write+0xf9/0x300\\nio_issue_sqe+0x3c3/0x1d30\\n? sysvec_reschedule_ipi+0x6c/0x80\\n__io_queue_sqe+0x33/0x240\\n? fget+0x76/0xa0\\nio_submit_sqes+0xe6a/0x18d0\\n? __fget_light+0xd1/0x100\\n__x64_sys_io_uring_enter+0x199/0x880\\n? __context_tracking_enter+0x1f/0x70\\n? irqentry_exit_to_user_mode+0x24/0x30\\n? irqentry_exit+0x1d/0x30\\n? __context_tracking_exit+0xe/0x70\\ndo_syscall_64+0x3b/0x90\\nentry_SYSCALL_64_after_hwframe+0x61/0xcb\\nRIP: 0033:0x7fc97c11a7be\\n\\t\u003c snip \u003e\\n\u003c/TASK\u003e\\n---[ end trace 48b2e0e67debcaeb ]---\\nRIP: 0010:internal_get_user_pages_fast+0x340/0x990\\n\\t\u003c snip \u003e\\nKernel panic - not syncing: Fatal exception\\nKernel Offset: disabled\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/gup: fix gup_pud_range() for dax Para dax pud, pud_huge() devuelve true en x86. Por lo tanto, la funci\\u00f3n funciona siempre que hugetlb est\\u00e9 configurado. Sin embargo, dax no depende de hugetlb. el commit 414fd080d125 (\\\"mm/gup: fix gup_pmd_range() for dax\\\") corrigi\\u00f3 los PMD enormes respaldados por devmap, pero omiti\\u00f3 los PUD enormes respaldados por devmap. Corrija esto tambi\\u00e9n. Esto corrige el siguiente p\\u00e1nico del kernel: error de protecci\\u00f3n general, probablemente para la direcci\\u00f3n no can\\u00f3nica 0x69e7c000cc478: 0000 [#1] SMP \u0026lt; snip \u0026gt; Call Trace:  get_user_pages_fast+0x1f/0x40 iov_iter_get_pages+0xc6/0x3b0 ? mempool_alloc+0x5d/0x170 bio_iov_iter_get_pages+0x82/0x4e0 ? bvec_alloc+0x91/0xc0 ? bio_alloc_bioset+0x19a/0x2a0 blkdev_direct_IO+0x282/0x480 ? __io_complete_rw_common+0xc0/0xc0 ? filemap_range_has_page+0x82/0xc0 generic_file_direct_write+0x9d/0x1a0? inode_update_time+0x24/0x30 __generic_file_write_iter+0xbd/0x1e0 blkdev_write_iter+0xb4/0x150 ? io_import_iovec+0x8d/0x340 io_write+0xf9/0x300 io_issue_sqe+0x3c3/0x1d30 ? sysvec_reschedule_ipi+0x6c/0x80 __io_queue_sqe+0x33/0x240 ? fget+0x76/0xa0 io_submit_sqes+0xe6a/0x18d0 ? __fget_light+0xd1/0x100 __x64_sys_io_uring_enter+0x199/0x880 ? __context_tracking_enter+0x1f/0x70 ? irqentry_exit_to_user_mode+0x24/0x30 ? irqentry_exit+0x1d/0x30 ? __context_tracking_exit+0xe/0x70 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fc97c11a7be \u0026lt; snip \u0026gt;  ---[ fin del seguimiento 48b2e0e67debcaeb ]--- RIP: 0010:internal_get_user_pages_fast+0x340/0x990 \u0026lt; snip \u0026gt; P\\u00e1nico del n\\u00facleo: no se sincroniza: Excepci\\u00f3n fatal Desplazamiento del n\\u00facleo: deshabilitado\"}]",
      "id": "CVE-2022-48986",
      "lastModified": "2024-11-01T15:30:13.770",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-10-21T20:15:10.527",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/04edfa3dc06ecfc6133a33bc7271298782dee875\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/3ac29732a2ffa64c7de13a072b0f2848b9c11037\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e06d13c36ded750c72521b600293befebb4e56c5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f1cf856123ceb766c49967ec79b841030fa1741f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/fcd0ccd836ffad73d98a66f6fea7b16f735ea920\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48986\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T20:15:10.527\",\"lastModified\":\"2026-08-04T10:17:29.487\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/gup: fix gup_pud_range() for dax\\n\\nFor dax pud, pud_huge() returns true on x86. So the function works as long\\nas hugetlb is configured. However, dax doesn\u0027t depend on hugetlb.\\nCommit 414fd080d125 (\\\"mm/gup: fix gup_pmd_range() for dax\\\") fixed\\ndevmap-backed huge PMDs, but missed devmap-backed huge PUDs. Fix this as\\nwell.\\n\\nThis fixes the below kernel panic:\\n\\ngeneral protection fault, probably for non-canonical address 0x69e7c000cc478: 0000 [#1] SMP\\n\\t\u003c snip \u003e\\nCall Trace:\\n\u003cTASK\u003e\\nget_user_pages_fast+0x1f/0x40\\niov_iter_get_pages+0xc6/0x3b0\\n? mempool_alloc+0x5d/0x170\\nbio_iov_iter_get_pages+0x82/0x4e0\\n? bvec_alloc+0x91/0xc0\\n? bio_alloc_bioset+0x19a/0x2a0\\nblkdev_direct_IO+0x282/0x480\\n? __io_complete_rw_common+0xc0/0xc0\\n? filemap_range_has_page+0x82/0xc0\\ngeneric_file_direct_write+0x9d/0x1a0\\n? inode_update_time+0x24/0x30\\n__generic_file_write_iter+0xbd/0x1e0\\nblkdev_write_iter+0xb4/0x150\\n? io_import_iovec+0x8d/0x340\\nio_write+0xf9/0x300\\nio_issue_sqe+0x3c3/0x1d30\\n? sysvec_reschedule_ipi+0x6c/0x80\\n__io_queue_sqe+0x33/0x240\\n? fget+0x76/0xa0\\nio_submit_sqes+0xe6a/0x18d0\\n? __fget_light+0xd1/0x100\\n__x64_sys_io_uring_enter+0x199/0x880\\n? __context_tracking_enter+0x1f/0x70\\n? irqentry_exit_to_user_mode+0x24/0x30\\n? irqentry_exit+0x1d/0x30\\n? __context_tracking_exit+0xe/0x70\\ndo_syscall_64+0x3b/0x90\\nentry_SYSCALL_64_after_hwframe+0x61/0xcb\\nRIP: 0033:0x7fc97c11a7be\\n\\t\u003c snip \u003e\\n\u003c/TASK\u003e\\n---[ end trace 48b2e0e67debcaeb ]---\\nRIP: 0010:internal_get_user_pages_fast+0x340/0x990\\n\\t\u003c snip \u003e\\nKernel panic - not syncing: Fatal exception\\nKernel Offset: disabled\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/gup: fix gup_pud_range() for dax Para dax pud, pud_huge() devuelve true en x86. Por lo tanto, la funci\u00f3n funciona siempre que hugetlb est\u00e9 configurado. Sin embargo, dax no depende de hugetlb. el commit 414fd080d125 (\\\"mm/gup: fix gup_pmd_range() for dax\\\") corrigi\u00f3 los PMD enormes respaldados por devmap, pero omiti\u00f3 los PUD enormes respaldados por devmap. Corrija esto tambi\u00e9n. Esto corrige el siguiente p\u00e1nico del kernel: error de protecci\u00f3n general, probablemente para la direcci\u00f3n no can\u00f3nica 0x69e7c000cc478: 0000 [#1] SMP \u0026lt; snip \u0026gt; Call Trace:  get_user_pages_fast+0x1f/0x40 iov_iter_get_pages+0xc6/0x3b0 ? mempool_alloc+0x5d/0x170 bio_iov_iter_get_pages+0x82/0x4e0 ? bvec_alloc+0x91/0xc0 ? bio_alloc_bioset+0x19a/0x2a0 blkdev_direct_IO+0x282/0x480 ? __io_complete_rw_common+0xc0/0xc0 ? filemap_range_has_page+0x82/0xc0 generic_file_direct_write+0x9d/0x1a0? inode_update_time+0x24/0x30 __generic_file_write_iter+0xbd/0x1e0 blkdev_write_iter+0xb4/0x150 ? io_import_iovec+0x8d/0x340 io_write+0xf9/0x300 io_issue_sqe+0x3c3/0x1d30 ? sysvec_reschedule_ipi+0x6c/0x80 __io_queue_sqe+0x33/0x240 ? fget+0x76/0xa0 io_submit_sqes+0xe6a/0x18d0 ? __fget_light+0xd1/0x100 __x64_sys_io_uring_enter+0x199/0x880 ? __context_tracking_enter+0x1f/0x70 ? irqentry_exit_to_user_mode+0x24/0x30 ? irqentry_exit+0x1d/0x30 ? __context_tracking_exit+0xe/0x70 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fc97c11a7be \u0026lt; snip \u0026gt;  ---[ fin del seguimiento 48b2e0e67debcaeb ]--- RIP: 0010:internal_get_user_pages_fast+0x340/0x990 \u0026lt; snip \u0026gt; P\u00e1nico del n\u00facleo: no se sincroniza: Excepci\u00f3n fatal Desplazamiento del n\u00facleo: deshabilitado\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"mm/gup.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"414fd080d125408cb15d04ff4907e1dd8145c8c7\",\"lessThan\":\"04edfa3dc06ecfc6133a33bc7271298782dee875\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"414fd080d125408cb15d04ff4907e1dd8145c8c7\",\"lessThan\":\"f1cf856123ceb766c49967ec79b841030fa1741f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"414fd080d125408cb15d04ff4907e1dd8145c8c7\",\"lessThan\":\"3ac29732a2ffa64c7de13a072b0f2848b9c11037\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"414fd080d125408cb15d04ff4907e1dd8145c8c7\",\"lessThan\":\"e06d13c36ded750c72521b600293befebb4e56c5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"414fd080d125408cb15d04ff4907e1dd8145c8c7\",\"lessThan\":\"fcd0ccd836ffad73d98a66f6fea7b16f735ea920\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c133d8eb894cb280f331608c6f1962ba9fbfe6b0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"538162d21ac877b060dc057c89f13718f5caffc5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b1a7762e0dac5db42a003009fdcb425f10baa07\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.9.165\",\"lessThan\":\"4.10\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.14.108\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.19.31\",\"lessThan\":\"4.20\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"mm/gup.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.227\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.159\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.83\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0.13\",\"lessThanOrEqual\":\"6.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-22T13:17:13.077740Z\",\"id\":\"CVE-2022-48986\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.9.165\",\"versionEndExcluding\":\"4.10\",\"matchCriteriaId\":\"03D696FD-2217-4673-A661-651833DB97FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.14.108\",\"versionEndExcluding\":\"4.15\",\"matchCriteriaId\":\"8EA0A3D7-55DF-4AF3-90C1-D65B1FFBF3BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.19.31\",\"versionEndExcluding\":\"4.20\",\"matchCriteriaId\":\"C208F54A-1F85-44EF-9E91-6DA461A49CA0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.0\",\"versionEndExcluding\":\"5.4.227\",\"matchCriteriaId\":\"75ADB045-951E-4837-969B-C2C77523AD98\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.159\",\"matchCriteriaId\":\"7318B597-DFFD-4BBC-A947-539D6E30D82A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.83\",\"matchCriteriaId\":\"90897BD1-104D-4CFF-94F5-29F9041217FB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.0.13\",\"matchCriteriaId\":\"389392A7-81C4-4C26-884B-8C7CF0F53DA4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E7E331DA-1FB0-4DEC-91AC-7DA69D461C11\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"17F0B248-42CF-4AE6-A469-BB1BAE7F4705\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2422816-0C14-4B5E-A1E6-A9D776E5C49B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"35B26BE4-43A6-4A36-A7F6-5B3F572D9186\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3FFFB0B3-930D-408A-91E2-BAE0C2715D80\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"8535320E-A0DB-4277-800E-D0CE5BBA59E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"21718AA4-4056-40F2-968E-BDAA465A7872\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04edfa3dc06ecfc6133a33bc7271298782dee875\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3ac29732a2ffa64c7de13a072b0f2848b9c11037\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e06d13c36ded750c72521b600293befebb4e56c5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f1cf856123ceb766c49967ec79b841030fa1741f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fcd0ccd836ffad73d98a66f6fea7b16f735ea920\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T19:45:09+00:00",
      "cve": "CVE-2022-48986",
      "id": "CVE-2022-48986",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "166",
      "product_status:known_not_affected": "32",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm/gup: fix gup_pud_range() for dax",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-48986.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T02:06:25Z",
      "cve": "CVE-2022-48986",
      "id": "CVE-2022-48986",
      "initial_release_date": "2024-10-22T14:22:49Z",
      "product_status:known_not_affected": "561",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-48986",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-48986.json",
      "version": "25"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48986\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:17:13.077740Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:17:16.285Z\"}}], \"cna\": {\"title\": \"mm/gup: fix gup_pud_range() for dax\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Exploitation requires local access to mmap a device-DAX mapping (/dev/dax with PUD alignment) and trigger get_user_pages_fast via a local syscall path such as O_DIRECT/io_uring; it is not reachable from the network stack.\\nAC:L - Once a vulnerable kernel has a PUD-sized DAX mapping, the attacker fully controls the mapping contents and the GUP trigger, so the incorrect page-table walk or crash can be induced reliably without races or victim-dependent timing.\\nPR:L - The DAX driver performs no capability check beyond ordinary file permissions on /dev/dax; an unprivileged user granted access to that device (common for PMEM/CXL workloads) can mmap it and trigger GUP without real root.\\nUI:N - The attacker triggers the bug entirely through their own syscalls (mmap plus O_DIRECT/io_uring or other GUP users); no separate victim action is required.\\nS:U - Impact is confined to the same kernel security authority (local DoS or memory access within the host kernel); this is not a VM/IOMMU escape or other cross-boundary scope change.\\nC:H - When HUGETLB is disabled, gup_pud_range() treats a DAX PUD as a page-table pointer into attacker-controlled DAX memory in the linear map, so crafted PTEs can pin arbitrary valid pages that O_DIRECT write then exfiltrates to storage.\\nI:H - The same confused GUP walk can pin arbitrary pages as the destination of O_DIRECT reads, yielding an arbitrary physical-memory write primitive and enabling further control-flow hijacking.\\nA:H - Uncrafted or invalid walks produce a general protection fault and kernel panic in get_user_pages_fast, as shown in the fix commit\\u2019s reproducer call trace.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"414fd080d125408cb15d04ff4907e1dd8145c8c7\", \"lessThan\": \"04edfa3dc06ecfc6133a33bc7271298782dee875\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"414fd080d125408cb15d04ff4907e1dd8145c8c7\", \"lessThan\": \"f1cf856123ceb766c49967ec79b841030fa1741f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"414fd080d125408cb15d04ff4907e1dd8145c8c7\", \"lessThan\": \"3ac29732a2ffa64c7de13a072b0f2848b9c11037\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"414fd080d125408cb15d04ff4907e1dd8145c8c7\", \"lessThan\": \"e06d13c36ded750c72521b600293befebb4e56c5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"414fd080d125408cb15d04ff4907e1dd8145c8c7\", \"lessThan\": \"fcd0ccd836ffad73d98a66f6fea7b16f735ea920\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c133d8eb894cb280f331608c6f1962ba9fbfe6b0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"538162d21ac877b060dc057c89f13718f5caffc5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8b1a7762e0dac5db42a003009fdcb425f10baa07\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4.9.165\", \"lessThan\": \"4.10\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.14.108\", \"lessThan\": \"4.15\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"4.19.31\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}], \"programFiles\": [\"mm/gup.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.0\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.227\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.159\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.83\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.0.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.0.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"mm/gup.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/04edfa3dc06ecfc6133a33bc7271298782dee875\"}, {\"url\": \"https://git.kernel.org/stable/c/f1cf856123ceb766c49967ec79b841030fa1741f\"}, {\"url\": \"https://git.kernel.org/stable/c/3ac29732a2ffa64c7de13a072b0f2848b9c11037\"}, {\"url\": \"https://git.kernel.org/stable/c/e06d13c36ded750c72521b600293befebb4e56c5\"}, {\"url\": \"https://git.kernel.org/stable/c/fcd0ccd836ffad73d98a66f6fea7b16f735ea920\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/gup: fix gup_pud_range() for dax\\n\\nFor dax pud, pud_huge() returns true on x86. So the function works as long\\nas hugetlb is configured. However, dax doesn\u0027t depend on hugetlb.\\nCommit 414fd080d125 (\\\"mm/gup: fix gup_pmd_range() for dax\\\") fixed\\ndevmap-backed huge PMDs, but missed devmap-backed huge PUDs. Fix this as\\nwell.\\n\\nThis fixes the below kernel panic:\\n\\ngeneral protection fault, probably for non-canonical address 0x69e7c000cc478: 0000 [#1] SMP\\n\\t\u003c snip \u003e\\nCall Trace:\\n\u003cTASK\u003e\\nget_user_pages_fast+0x1f/0x40\\niov_iter_get_pages+0xc6/0x3b0\\n? mempool_alloc+0x5d/0x170\\nbio_iov_iter_get_pages+0x82/0x4e0\\n? bvec_alloc+0x91/0xc0\\n? bio_alloc_bioset+0x19a/0x2a0\\nblkdev_direct_IO+0x282/0x480\\n? __io_complete_rw_common+0xc0/0xc0\\n? filemap_range_has_page+0x82/0xc0\\ngeneric_file_direct_write+0x9d/0x1a0\\n? inode_update_time+0x24/0x30\\n__generic_file_write_iter+0xbd/0x1e0\\nblkdev_write_iter+0xb4/0x150\\n? io_import_iovec+0x8d/0x340\\nio_write+0xf9/0x300\\nio_issue_sqe+0x3c3/0x1d30\\n? sysvec_reschedule_ipi+0x6c/0x80\\n__io_queue_sqe+0x33/0x240\\n? fget+0x76/0xa0\\nio_submit_sqes+0xe6a/0x18d0\\n? __fget_light+0xd1/0x100\\n__x64_sys_io_uring_enter+0x199/0x880\\n? __context_tracking_enter+0x1f/0x70\\n? irqentry_exit_to_user_mode+0x24/0x30\\n? irqentry_exit+0x1d/0x30\\n? __context_tracking_exit+0xe/0x70\\ndo_syscall_64+0x3b/0x90\\nentry_SYSCALL_64_after_hwframe+0x61/0xcb\\nRIP: 0033:0x7fc97c11a7be\\n\\t\u003c snip \u003e\\n\u003c/TASK\u003e\\n---[ end trace 48b2e0e67debcaeb ]---\\nRIP: 0010:internal_get_user_pages_fast+0x340/0x990\\n\\t\u003c snip \u003e\\nKernel panic - not syncing: Fatal exception\\nKernel Offset: disabled\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.227\", \"versionStartIncluding\": \"5.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.159\", \"versionStartIncluding\": \"5.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.83\", \"versionStartIncluding\": \"5.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.0.13\", \"versionStartIncluding\": \"5.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1\", \"versionStartIncluding\": \"5.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.9.165\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.14.108\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.19.31\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:53:16.291Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48986\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:53:16.291Z\", \"dateReserved\": \"2024-08-22T01:27:53.634Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T20:06:02.502Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.