GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49426 (GCVE-0-2022-49426)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:12 – Updated: 2026-08-05 08:55
VLAI
Title
iommu/arm-smmu-v3-sva: Fix mm use-after-free
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3-sva: Fix mm use-after-free We currently call arm64_mm_context_put() without holding a reference to the mm, which can result in use-after-free. Call mmgrab()/mmdrop() to ensure the mm only gets freed after we unpinned the ASID.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-27 18:16 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 32784a9562fb0518b12e9797ee2aec52214adf6f , < fc90f13ea0dcd960e5002d204fa55cec4e0db2fa (git)
Affected: 32784a9562fb0518b12e9797ee2aec52214adf6f , < e3cbbdbff8a4db5d053c53fd71be62ccccdb52b0 (git)
Affected: 32784a9562fb0518b12e9797ee2aec52214adf6f , < 9aa215450888cf29af0c479e14a712dc6b0c506c (git)
Affected: 32784a9562fb0518b12e9797ee2aec52214adf6f , < cbd23144f7662b00bcde32a938c4a4057e476d68 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.11
Unaffected: 0 , < 5.11 (semver)
Unaffected: 5.15.46 , ≤ 5.15.* (semver)
Unaffected: 5.17.14 , ≤ 5.17.* (semver)
Unaffected: 5.18.3 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49426",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T18:16:10.824439Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:22:32.946Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fc90f13ea0dcd960e5002d204fa55cec4e0db2fa",
              "status": "affected",
              "version": "32784a9562fb0518b12e9797ee2aec52214adf6f",
              "versionType": "git"
            },
            {
              "lessThan": "e3cbbdbff8a4db5d053c53fd71be62ccccdb52b0",
              "status": "affected",
              "version": "32784a9562fb0518b12e9797ee2aec52214adf6f",
              "versionType": "git"
            },
            {
              "lessThan": "9aa215450888cf29af0c479e14a712dc6b0c506c",
              "status": "affected",
              "version": "32784a9562fb0518b12e9797ee2aec52214adf6f",
              "versionType": "git"
            },
            {
              "lessThan": "cbd23144f7662b00bcde32a938c4a4057e476d68",
              "status": "affected",
              "version": "32784a9562fb0518b12e9797ee2aec52214adf6f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.46",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.14",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.3",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/arm-smmu-v3-sva: Fix mm use-after-free\n\nWe currently call arm64_mm_context_put() without holding a reference to\nthe mm, which can result in use-after-free. Call mmgrab()/mmdrop() to\nensure the mm only gets freed after we unpinned the ASID."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via local SVA bind/unbind on ARM SMMUv3, typically through open/close of a uacce char device (iommu_sva_bind_device \u2192 arm_smmu_sva_bind \u2192 arm_smmu_alloc_shared_cd / free_shared_cd), not via network packet processing.\nAC:L - An attacker who can open the accelerator device fully controls bind and unbind (open/close or process exit), directly driving the missing-mmgrab UAF path; per kernel UAF guidance this is Low complexity.\nPR:L - No capability check exists on the uacce open path; UACCE is explicitly a user-space accelerator interface, so a normal local user with device-node access (common on HiSilicon/WarpDrive deployments) can trigger the bug without real root.\nUI:N - The attacker triggers the vulnerability themselves by binding and later unbinding SVA; no separate victim action is required.\nS:U - This is a kernel mm_struct use-after-free enabling host privilege escalation within the same OS security authority, not a guest-to-host escape or a direct IOMMU/DMA isolation bypass.\nC:H - Use-after-free of mm_struct while unpinning the ASID lets the attacker reclaim and control the freed object, enabling arbitrary kernel read primitives.\nI:H - The same UAF is exploitable for heap manipulation and arbitrary write / control-flow hijacking in the kernel.\nA:H - Dereferencing the freed mm in arm64_mm_context_put can oops/panic the kernel even without full exploitation, so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:55:11.768Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fc90f13ea0dcd960e5002d204fa55cec4e0db2fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3cbbdbff8a4db5d053c53fd71be62ccccdb52b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/9aa215450888cf29af0c479e14a712dc6b0c506c"
        },
        {
          "url": "https://git.kernel.org/stable/c/cbd23144f7662b00bcde32a938c4a4057e476d68"
        }
      ],
      "title": "iommu/arm-smmu-v3-sva: Fix mm use-after-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49426",
    "datePublished": "2025-02-26T02:12:47.206Z",
    "dateReserved": "2025-02-26T02:08:31.569Z",
    "dateUpdated": "2026-08-05T08:55:11.768Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49426",
      "date": "2026-09-16",
      "epss": "0.00288",
      "percentile": "0.21354"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49426\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:19.073\",\"lastModified\":\"2026-06-17T05:18:01.000\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommu/arm-smmu-v3-sva: Fix mm use-after-free\\n\\nWe currently call arm64_mm_context_put() without holding a reference to\\nthe mm, which can result in use-after-free. Call mmgrab()/mmdrop() to\\nensure the mm only gets freed after we unpinned the ASID.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: iommu/arm-smmu-v3-sva: Se solucion\u00f3 el problema de use-after-free de mm. Actualmente, llamamos a arm64_mm_context_put() sin mantener una referencia a mm, lo que puede resultar en un problema de use-after-free. Llamamos a mmgrab()/mmdrop() para asegurarnos de que mm solo se libere despu\u00e9s de que desanclemos el ASID.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"32784a9562fb0518b12e9797ee2aec52214adf6f\",\"lessThan\":\"fc90f13ea0dcd960e5002d204fa55cec4e0db2fa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"32784a9562fb0518b12e9797ee2aec52214adf6f\",\"lessThan\":\"e3cbbdbff8a4db5d053c53fd71be62ccccdb52b0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"32784a9562fb0518b12e9797ee2aec52214adf6f\",\"lessThan\":\"9aa215450888cf29af0c479e14a712dc6b0c506c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"32784a9562fb0518b12e9797ee2aec52214adf6f\",\"lessThan\":\"cbd23144f7662b00bcde32a938c4a4057e476d68\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.46\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17.14\",\"lessThanOrEqual\":\"5.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18.3\",\"lessThanOrEqual\":\"5.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-27T18:16:10.824439Z\",\"id\":\"CVE-2022-49426\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.46\",\"matchCriteriaId\":\"20D41697-0E8B-4B7D-8842-F17BF2AA21E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.17.14\",\"matchCriteriaId\":\"15E2DD33-2255-4B76-9C15-04FF8CBAB252\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"5.18.3\",\"matchCriteriaId\":\"8E122216-2E9E-4B3E-B7B8-D575A45BA3C2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/9aa215450888cf29af0c479e14a712dc6b0c506c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cbd23144f7662b00bcde32a938c4a4057e476d68\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e3cbbdbff8a4db5d053c53fd71be62ccccdb52b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fc90f13ea0dcd960e5002d204fa55cec4e0db2fa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T21:06:51+00:00",
      "cve": "CVE-2022-49426",
      "id": "CVE-2022-49426",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "286",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "134",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iommu/arm-smmu-v3-sva: Fix mm use-after-free",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49426.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-28T02:40:52Z",
      "cve": "CVE-2022-49426",
      "id": "CVE-2022-49426",
      "initial_release_date": "2025-02-27T03:07:06Z",
      "product_status:known_affected": "334",
      "product_status:known_not_affected": "300",
      "product_status:recommended": "265",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49426",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49426.json",
      "version": "46"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-49426\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-27T18:16:10.824439Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-27T18:16:12.353Z\"}}], \"cna\": {\"title\": \"iommu/arm-smmu-v3-sva: Fix mm use-after-free\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is reached only via local SVA bind/unbind on ARM SMMUv3, typically through open/close of a uacce char device (iommu_sva_bind_device \\u2192 arm_smmu_sva_bind \\u2192 arm_smmu_alloc_shared_cd / free_shared_cd), not via network packet processing.\\nAC:L - An attacker who can open the accelerator device fully controls bind and unbind (open/close or process exit), directly driving the missing-mmgrab UAF path; per kernel UAF guidance this is Low complexity.\\nPR:L - No capability check exists on the uacce open path; UACCE is explicitly a user-space accelerator interface, so a normal local user with device-node access (common on HiSilicon/WarpDrive deployments) can trigger the bug without real root.\\nUI:N - The attacker triggers the vulnerability themselves by binding and later unbinding SVA; no separate victim action is required.\\nS:U - This is a kernel mm_struct use-after-free enabling host privilege escalation within the same OS security authority, not a guest-to-host escape or a direct IOMMU/DMA isolation bypass.\\nC:H - Use-after-free of mm_struct while unpinning the ASID lets the attacker reclaim and control the freed object, enabling arbitrary kernel read primitives.\\nI:H - The same UAF is exploitable for heap manipulation and arbitrary write / control-flow hijacking in the kernel.\\nA:H - Dereferencing the freed mm in arm64_mm_context_put can oops/panic the kernel even without full exploitation, so availability impact is High.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"32784a9562fb0518b12e9797ee2aec52214adf6f\", \"lessThan\": \"fc90f13ea0dcd960e5002d204fa55cec4e0db2fa\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"32784a9562fb0518b12e9797ee2aec52214adf6f\", \"lessThan\": \"e3cbbdbff8a4db5d053c53fd71be62ccccdb52b0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"32784a9562fb0518b12e9797ee2aec52214adf6f\", \"lessThan\": \"9aa215450888cf29af0c479e14a712dc6b0c506c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"32784a9562fb0518b12e9797ee2aec52214adf6f\", \"lessThan\": \"cbd23144f7662b00bcde32a938c4a4057e476d68\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.46\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.17.*\"}, {\"status\": \"unaffected\", \"version\": \"5.18.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.18.*\"}, {\"status\": \"unaffected\", \"version\": \"5.19\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/fc90f13ea0dcd960e5002d204fa55cec4e0db2fa\"}, {\"url\": \"https://git.kernel.org/stable/c/e3cbbdbff8a4db5d053c53fd71be62ccccdb52b0\"}, {\"url\": \"https://git.kernel.org/stable/c/9aa215450888cf29af0c479e14a712dc6b0c506c\"}, {\"url\": \"https://git.kernel.org/stable/c/cbd23144f7662b00bcde32a938c4a4057e476d68\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommu/arm-smmu-v3-sva: Fix mm use-after-free\\n\\nWe currently call arm64_mm_context_put() without holding a reference to\\nthe mm, which can result in use-after-free. Call mmgrab()/mmdrop() to\\nensure the mm only gets freed after we unpinned the ASID.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.46\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17.14\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.18.3\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.19\", \"versionStartIncluding\": \"5.11\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:55:11.768Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-49426\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:55:11.768Z\", \"dateReserved\": \"2025-02-26T02:08:31.569Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-26T02:12:47.206Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.