CVE-2022-48991 (GCVE-0-2022-48991)

Vulnerability from cvelistv5 – Published: 2024-10-21 20:06 – Updated: 2026-08-05 08:53
VLAI
Title
mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths Any codepath that zaps page table entries must invoke MMU notifiers to ensure that secondary MMUs (like KVM) don't keep accessing pages which aren't mapped anymore. Secondary MMUs don't hold their own references to pages that are mirrored over, so failing to notify them can lead to page use-after-free. I'm marking this as addressing an issue introduced in commit f3f0e1d2150b ("khugepaged: add support of collapse for tmpfs/shmem pages"), but most of the security impact of this only came in commit 27e1f8273113 ("khugepaged: enable collapse pmd for pte-mapped THP"), which actually omitted flushes for the removal of present PTEs, not just for the removal of empty page tables.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 , < 275c626c131cfe141beeb6c575e31fa53d32da19 (git)
Affected: f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 , < c23105673228c349739e958fa33955ed8faddcaf (git)
Affected: f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 , < ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3 (git)
Affected: f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 , < 5ffc2a75534d9d74d49760f983f8eb675fa63d69 (git)
Affected: f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 , < 7f445ca2e0e59c7971d0b7b853465e50844ab596 (git)
Affected: f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 , < 1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3 (git)
Affected: f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 , < 5450535901d89a5dcca5fbbc59a24fe89caeb465 (git)
Affected: f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 , < f268f6cf875f3220afc77bdd0bf1bb136eb54db9 (git)
Create a notification for this product.
Linux Linux Affected: 4.8
Unaffected: 0 , < 4.8 (semver)
Unaffected: 4.9.337 , ≤ 4.9.* (semver)
Unaffected: 4.14.303 , ≤ 4.14.* (semver)
Unaffected: 4.19.270 , ≤ 4.19.* (semver)
Unaffected: 5.4.227 , ≤ 5.4.* (semver)
Unaffected: 5.10.159 , ≤ 5.10.* (semver)
Unaffected: 5.15.83 , ≤ 5.15.* (semver)
Unaffected: 6.0.13 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48991",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:16:32.481668Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:18:42.186Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/khugepaged.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "275c626c131cfe141beeb6c575e31fa53d32da19",
              "status": "affected",
              "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30",
              "versionType": "git"
            },
            {
              "lessThan": "c23105673228c349739e958fa33955ed8faddcaf",
              "status": "affected",
              "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30",
              "versionType": "git"
            },
            {
              "lessThan": "ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3",
              "status": "affected",
              "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30",
              "versionType": "git"
            },
            {
              "lessThan": "5ffc2a75534d9d74d49760f983f8eb675fa63d69",
              "status": "affected",
              "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30",
              "versionType": "git"
            },
            {
              "lessThan": "7f445ca2e0e59c7971d0b7b853465e50844ab596",
              "status": "affected",
              "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30",
              "versionType": "git"
            },
            {
              "lessThan": "1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3",
              "status": "affected",
              "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30",
              "versionType": "git"
            },
            {
              "lessThan": "5450535901d89a5dcca5fbbc59a24fe89caeb465",
              "status": "affected",
              "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30",
              "versionType": "git"
            },
            {
              "lessThan": "f268f6cf875f3220afc77bdd0bf1bb136eb54db9",
              "status": "affected",
              "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/khugepaged.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.337",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.303",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.227",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.337",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.303",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.270",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.227",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.159",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.83",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.13",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/khugepaged: invoke MMU notifiers in shmem/file collapse paths\n\nAny codepath that zaps page table entries must invoke MMU notifiers to\nensure that secondary MMUs (like KVM) don\u0027t keep accessing pages which\naren\u0027t mapped anymore.  Secondary MMUs don\u0027t hold their own references to\npages that are mirrored over, so failing to notify them can lead to page\nuse-after-free.\n\nI\u0027m marking this as addressing an issue introduced in commit f3f0e1d2150b\n(\"khugepaged: add support of collapse for tmpfs/shmem pages\"), but most of\nthe security impact of this only came in commit 27e1f8273113 (\"khugepaged:\nenable collapse pmd for pte-mapped THP\"), which actually omitted flushes\nfor the removal of present PTEs, not just for the removal of empty page\ntables."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered by local mm paths (khugepaged or madvise/MADV_COLLAPSE) that retract host page tables mirrored into KVM; exploitation requires local or guest access to that KVM secondary MMU, not network or adjacent-link input.\nAC:L - An attacker who controls shmem/file-backed guest memory can reliably force collapse (MADV_COLLAPSE or khugepaged) and keep accessing via KVM; Jann Horn demonstrated a working KVM reproducer that reads freed page contents, with no victim-only timing or layout precondition.\nPR:L - Exploitation needs only the ability to run as an unprivileged local user with KVM access or as a KVM guest; host root or init-namespace admin capabilities are not required.\nUI:N - No separate victim action is required; the attacker (or attacker-controlled guest) drives memory setup, collapse, and secondary-MMU access themselves.\nS:C - Failing to invalidate KVM\u2019s secondary MMU leaves the guest mapped to freed host pages after THP collapse, enabling guest-to-host memory access and crossing the guest/hypervisor security boundary.\nC:H - This is a page use-after-free through KVM; the public reproducer reads PAGE_POISON from freed file THP pages, and page reuse yields a host-kernel arbitrary-read primitive.\nI:H - Stale KVM SPTEs to freed pages also provide a write path once those pages are reused, enabling host memory corruption and control-flow hijacking consistent with UAF escape-class impact.\nA:H - Use-after-free through stale secondary-MMU mappings can oops/panic the host when freed or reused pages are accessed, and a malicious guest can repeat the trigger to deny service to the host and colocated guests."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:53:20.576Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/275c626c131cfe141beeb6c575e31fa53d32da19"
        },
        {
          "url": "https://git.kernel.org/stable/c/c23105673228c349739e958fa33955ed8faddcaf"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ffc2a75534d9d74d49760f983f8eb675fa63d69"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f445ca2e0e59c7971d0b7b853465e50844ab596"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/5450535901d89a5dcca5fbbc59a24fe89caeb465"
        },
        {
          "url": "https://git.kernel.org/stable/c/f268f6cf875f3220afc77bdd0bf1bb136eb54db9"
        }
      ],
      "title": "mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48991",
    "datePublished": "2024-10-21T20:06:08.312Z",
    "dateReserved": "2024-08-22T01:27:53.636Z",
    "dateUpdated": "2026-08-05T08:53:20.576Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48991",
      "date": "2026-08-06",
      "epss": "0.00251",
      "percentile": "0.16532"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.8\", \"versionEndExcluding\": \"4.9.337\", \"matchCriteriaId\": \"3A7C6654-B729-4CE8-922E-B5675245AF0A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.10\", \"versionEndExcluding\": \"4.14.303\", \"matchCriteriaId\": \"1E7450AD-4739-46F0-B81B-C02E7B35A97B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.15\", \"versionEndExcluding\": \"4.19.270\", \"matchCriteriaId\": \"AE8904A3-99BE-4E49-9682-1F90A6373F4F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.20\", \"versionEndExcluding\": \"5.4.227\", \"matchCriteriaId\": \"8C752145-904B-474A-A7F2-E9F29353B0FE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.5\", \"versionEndExcluding\": \"5.10.159\", \"matchCriteriaId\": \"7318B597-DFFD-4BBC-A947-539D6E30D82A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.83\", \"matchCriteriaId\": \"90897BD1-104D-4CFF-94F5-29F9041217FB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.0.13\", \"matchCriteriaId\": \"389392A7-81C4-4C26-884B-8C7CF0F53DA4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"E7E331DA-1FB0-4DEC-91AC-7DA69D461C11\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"17F0B248-42CF-4AE6-A469-BB1BAE7F4705\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"E2422816-0C14-4B5E-A1E6-A9D776E5C49B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"35B26BE4-43A6-4A36-A7F6-5B3F572D9186\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*\", \"matchCriteriaId\": \"3FFFB0B3-930D-408A-91E2-BAE0C2715D80\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*\", \"matchCriteriaId\": \"8535320E-A0DB-4277-800E-D0CE5BBA59E8\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/khugepaged: invoke MMU notifiers in shmem/file collapse paths\\n\\nAny codepath that zaps page table entries must invoke MMU notifiers to\\nensure that secondary MMUs (like KVM) don\u0027t keep accessing pages which\\naren\u0027t mapped anymore.  Secondary MMUs don\u0027t hold their own references to\\npages that are mirrored over, so failing to notify them can lead to page\\nuse-after-free.\\n\\nI\u0027m marking this as addressing an issue introduced in commit f3f0e1d2150b\\n(\\\"khugepaged: add support of collapse for tmpfs/shmem pages\\\"), but most of\\nthe security impact of this only came in commit 27e1f8273113 (\\\"khugepaged:\\nenable collapse pmd for pte-mapped THP\\\"), which actually omitted flushes\\nfor the removal of present PTEs, not just for the removal of empty page\\ntables.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/khugepaged: invocar notificadores MMU en rutas de colapso de shmem/archivo Cualquier ruta de c\\u00f3digo que elimine las entradas de la tabla de p\\u00e1ginas debe invocar notificadores MMU para garantizar que las MMU secundarias (como KVM) no sigan accediendo a p\\u00e1ginas que ya no est\\u00e1n asignadas. Las MMU secundarias no mantienen sus propias referencias a p\\u00e1ginas que se reflejan, por lo que no notificarlas puede provocar el use-after-free de la p\\u00e1gina. Estoy marcando esto como una soluci\\u00f3n a un problema introducido en el commit f3f0e1d2150b (\\\"khugepaged: agregar compatibilidad con el colapso para p\\u00e1ginas tmpfs/shmem\\\"), pero la mayor parte del impacto de seguridad de esto solo se produjo en el commit 27e1f8273113 (\\\"khugepaged: habilitar el colapso pmd para THP asignado a pte\\\"), que en realidad omiti\\u00f3 los vaciados para la eliminaci\\u00f3n de PTE actuales, no solo para la eliminaci\\u00f3n de tablas de p\\u00e1ginas vac\\u00edas.\"}]",
      "id": "CVE-2022-48991",
      "lastModified": "2024-11-07T19:36:33.167",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-10-21T20:15:11.000",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/275c626c131cfe141beeb6c575e31fa53d32da19\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/5450535901d89a5dcca5fbbc59a24fe89caeb465\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/5ffc2a75534d9d74d49760f983f8eb675fa63d69\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/7f445ca2e0e59c7971d0b7b853465e50844ab596\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c23105673228c349739e958fa33955ed8faddcaf\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f268f6cf875f3220afc77bdd0bf1bb136eb54db9\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48991\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T20:15:11.000\",\"lastModified\":\"2026-08-04T10:17:30.070\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/khugepaged: invoke MMU notifiers in shmem/file collapse paths\\n\\nAny codepath that zaps page table entries must invoke MMU notifiers to\\nensure that secondary MMUs (like KVM) don\u0027t keep accessing pages which\\naren\u0027t mapped anymore.  Secondary MMUs don\u0027t hold their own references to\\npages that are mirrored over, so failing to notify them can lead to page\\nuse-after-free.\\n\\nI\u0027m marking this as addressing an issue introduced in commit f3f0e1d2150b\\n(\\\"khugepaged: add support of collapse for tmpfs/shmem pages\\\"), but most of\\nthe security impact of this only came in commit 27e1f8273113 (\\\"khugepaged:\\nenable collapse pmd for pte-mapped THP\\\"), which actually omitted flushes\\nfor the removal of present PTEs, not just for the removal of empty page\\ntables.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/khugepaged: invocar notificadores MMU en rutas de colapso de shmem/archivo Cualquier ruta de c\u00f3digo que elimine las entradas de la tabla de p\u00e1ginas debe invocar notificadores MMU para garantizar que las MMU secundarias (como KVM) no sigan accediendo a p\u00e1ginas que ya no est\u00e1n asignadas. Las MMU secundarias no mantienen sus propias referencias a p\u00e1ginas que se reflejan, por lo que no notificarlas puede provocar el use-after-free de la p\u00e1gina. Estoy marcando esto como una soluci\u00f3n a un problema introducido en el commit f3f0e1d2150b (\\\"khugepaged: agregar compatibilidad con el colapso para p\u00e1ginas tmpfs/shmem\\\"), pero la mayor parte del impacto de seguridad de esto solo se produjo en el commit 27e1f8273113 (\\\"khugepaged: habilitar el colapso pmd para THP asignado a pte\\\"), que en realidad omiti\u00f3 los vaciados para la eliminaci\u00f3n de PTE actuales, no solo para la eliminaci\u00f3n de tablas de p\u00e1ginas vac\u00edas.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"mm/khugepaged.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30\",\"lessThan\":\"275c626c131cfe141beeb6c575e31fa53d32da19\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30\",\"lessThan\":\"c23105673228c349739e958fa33955ed8faddcaf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30\",\"lessThan\":\"ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30\",\"lessThan\":\"5ffc2a75534d9d74d49760f983f8eb675fa63d69\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30\",\"lessThan\":\"7f445ca2e0e59c7971d0b7b853465e50844ab596\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30\",\"lessThan\":\"1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30\",\"lessThan\":\"5450535901d89a5dcca5fbbc59a24fe89caeb465\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30\",\"lessThan\":\"f268f6cf875f3220afc77bdd0bf1bb136eb54db9\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"mm/khugepaged.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.9.337\",\"lessThanOrEqual\":\"4.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.303\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.270\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.227\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.159\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.83\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0.13\",\"lessThanOrEqual\":\"6.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-22T13:16:32.481668Z\",\"id\":\"CVE-2022-48991\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.8\",\"versionEndExcluding\":\"4.9.337\",\"matchCriteriaId\":\"3A7C6654-B729-4CE8-922E-B5675245AF0A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10\",\"versionEndExcluding\":\"4.14.303\",\"matchCriteriaId\":\"1E7450AD-4739-46F0-B81B-C02E7B35A97B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.270\",\"matchCriteriaId\":\"AE8904A3-99BE-4E49-9682-1F90A6373F4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.227\",\"matchCriteriaId\":\"8C752145-904B-474A-A7F2-E9F29353B0FE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.159\",\"matchCriteriaId\":\"7318B597-DFFD-4BBC-A947-539D6E30D82A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.83\",\"matchCriteriaId\":\"90897BD1-104D-4CFF-94F5-29F9041217FB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.0.13\",\"matchCriteriaId\":\"389392A7-81C4-4C26-884B-8C7CF0F53DA4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E7E331DA-1FB0-4DEC-91AC-7DA69D461C11\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"17F0B248-42CF-4AE6-A469-BB1BAE7F4705\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2422816-0C14-4B5E-A1E6-A9D776E5C49B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"35B26BE4-43A6-4A36-A7F6-5B3F572D9186\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3FFFB0B3-930D-408A-91E2-BAE0C2715D80\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"8535320E-A0DB-4277-800E-D0CE5BBA59E8\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/275c626c131cfe141beeb6c575e31fa53d32da19\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5450535901d89a5dcca5fbbc59a24fe89caeb465\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5ffc2a75534d9d74d49760f983f8eb675fa63d69\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7f445ca2e0e59c7971d0b7b853465e50844ab596\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c23105673228c349739e958fa33955ed8faddcaf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f268f6cf875f3220afc77bdd0bf1bb136eb54db9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:45:01+00:00",
      "cve": "CVE-2022-48991",
      "id": "CVE-2022-48991",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-48991.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-05T01:16:01Z",
      "cve": "CVE-2022-48991",
      "id": "CVE-2022-48991",
      "initial_release_date": "2024-10-22T14:22:43Z",
      "product_status:known_affected": "409",
      "product_status:known_not_affected": "154",
      "product_status:recommended": "578",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-48991",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-48991.json",
      "version": "47"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48991\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:16:32.481668Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:16:37.120Z\"}}], \"cna\": {\"title\": \"mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is triggered by local mm paths (khugepaged or madvise/MADV_COLLAPSE) that retract host page tables mirrored into KVM; exploitation requires local or guest access to that KVM secondary MMU, not network or adjacent-link input.\\nAC:L - An attacker who controls shmem/file-backed guest memory can reliably force collapse (MADV_COLLAPSE or khugepaged) and keep accessing via KVM; Jann Horn demonstrated a working KVM reproducer that reads freed page contents, with no victim-only timing or layout precondition.\\nPR:L - Exploitation needs only the ability to run as an unprivileged local user with KVM access or as a KVM guest; host root or init-namespace admin capabilities are not required.\\nUI:N - No separate victim action is required; the attacker (or attacker-controlled guest) drives memory setup, collapse, and secondary-MMU access themselves.\\nS:C - Failing to invalidate KVM\\u2019s secondary MMU leaves the guest mapped to freed host pages after THP collapse, enabling guest-to-host memory access and crossing the guest/hypervisor security boundary.\\nC:H - This is a page use-after-free through KVM; the public reproducer reads PAGE_POISON from freed file THP pages, and page reuse yields a host-kernel arbitrary-read primitive.\\nI:H - Stale KVM SPTEs to freed pages also provide a write path once those pages are reused, enabling host memory corruption and control-flow hijacking consistent with UAF escape-class impact.\\nA:H - Use-after-free through stale secondary-MMU mappings can oops/panic the host when freed or reused pages are accessed, and a malicious guest can repeat the trigger to deny service to the host and colocated guests.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30\", \"lessThan\": \"275c626c131cfe141beeb6c575e31fa53d32da19\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30\", \"lessThan\": \"c23105673228c349739e958fa33955ed8faddcaf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30\", \"lessThan\": \"ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30\", \"lessThan\": \"5ffc2a75534d9d74d49760f983f8eb675fa63d69\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30\", \"lessThan\": \"7f445ca2e0e59c7971d0b7b853465e50844ab596\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30\", \"lessThan\": \"1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30\", \"lessThan\": \"5450535901d89a5dcca5fbbc59a24fe89caeb465\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3f0e1d2150b2b99da2cbdfaad000089efe9bf30\", \"lessThan\": \"f268f6cf875f3220afc77bdd0bf1bb136eb54db9\", \"versionType\": \"git\"}], \"programFiles\": [\"mm/khugepaged.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.9.337\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.9.*\"}, {\"status\": \"unaffected\", \"version\": \"4.14.303\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.270\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.227\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.159\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.83\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.0.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.0.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"mm/khugepaged.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/275c626c131cfe141beeb6c575e31fa53d32da19\"}, {\"url\": \"https://git.kernel.org/stable/c/c23105673228c349739e958fa33955ed8faddcaf\"}, {\"url\": \"https://git.kernel.org/stable/c/ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3\"}, {\"url\": \"https://git.kernel.org/stable/c/5ffc2a75534d9d74d49760f983f8eb675fa63d69\"}, {\"url\": \"https://git.kernel.org/stable/c/7f445ca2e0e59c7971d0b7b853465e50844ab596\"}, {\"url\": \"https://git.kernel.org/stable/c/1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3\"}, {\"url\": \"https://git.kernel.org/stable/c/5450535901d89a5dcca5fbbc59a24fe89caeb465\"}, {\"url\": \"https://git.kernel.org/stable/c/f268f6cf875f3220afc77bdd0bf1bb136eb54db9\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/khugepaged: invoke MMU notifiers in shmem/file collapse paths\\n\\nAny codepath that zaps page table entries must invoke MMU notifiers to\\nensure that secondary MMUs (like KVM) don\u0027t keep accessing pages which\\naren\u0027t mapped anymore.  Secondary MMUs don\u0027t hold their own references to\\npages that are mirrored over, so failing to notify them can lead to page\\nuse-after-free.\\n\\nI\u0027m marking this as addressing an issue introduced in commit f3f0e1d2150b\\n(\\\"khugepaged: add support of collapse for tmpfs/shmem pages\\\"), but most of\\nthe security impact of this only came in commit 27e1f8273113 (\\\"khugepaged:\\nenable collapse pmd for pte-mapped THP\\\"), which actually omitted flushes\\nfor the removal of present PTEs, not just for the removal of empty page\\ntables.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.9.337\", \"versionStartIncluding\": \"4.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.14.303\", \"versionStartIncluding\": \"4.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.270\", \"versionStartIncluding\": \"4.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.227\", \"versionStartIncluding\": \"4.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.159\", \"versionStartIncluding\": \"4.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.83\", \"versionStartIncluding\": \"4.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.0.13\", \"versionStartIncluding\": \"4.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1\", \"versionStartIncluding\": \"4.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:53:20.576Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48991\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:53:20.576Z\", \"dateReserved\": \"2024-08-22T01:27:53.636Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T20:06:08.312Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.