GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49567 (GCVE-0-2022-49567)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:23 – Updated: 2026-05-11 19:02
VLAI
Title
mm/mempolicy: fix uninit-value in mpol_rebind_policy()
Summary
In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix uninit-value in mpol_rebind_policy() mpol_set_nodemask()(mm/mempolicy.c) does not set up nodemask when pol->mode is MPOL_LOCAL. Check pol->mode before access pol->w.cpuset_mems_allowed in mpol_rebind_policy()(mm/mempolicy.c). BUG: KMSAN: uninit-value in mpol_rebind_policy mm/mempolicy.c:352 [inline] BUG: KMSAN: uninit-value in mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368 mpol_rebind_policy mm/mempolicy.c:352 [inline] mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368 cpuset_change_task_nodemask kernel/cgroup/cpuset.c:1711 [inline] cpuset_attach+0x787/0x15e0 kernel/cgroup/cpuset.c:2278 cgroup_migrate_execute+0x1023/0x1d20 kernel/cgroup/cgroup.c:2515 cgroup_migrate kernel/cgroup/cgroup.c:2771 [inline] cgroup_attach_task+0x540/0x8b0 kernel/cgroup/cgroup.c:2804 __cgroup1_procs_write+0x5cc/0x7a0 kernel/cgroup/cgroup-v1.c:520 cgroup1_tasks_write+0x94/0xb0 kernel/cgroup/cgroup-v1.c:539 cgroup_file_write+0x4c2/0x9e0 kernel/cgroup/cgroup.c:3852 kernfs_fop_write_iter+0x66a/0x9f0 fs/kernfs/file.c:296 call_write_iter include/linux/fs.h:2162 [inline] new_sync_write fs/read_write.c:503 [inline] vfs_write+0x1318/0x2030 fs/read_write.c:590 ksys_write+0x28b/0x510 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0xdb/0x120 fs/read_write.c:652 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] slab_alloc mm/slub.c:3259 [inline] kmem_cache_alloc+0x902/0x11c0 mm/slub.c:3264 mpol_new mm/mempolicy.c:293 [inline] do_set_mempolicy+0x421/0xb70 mm/mempolicy.c:853 kernel_set_mempolicy mm/mempolicy.c:1504 [inline] __do_sys_set_mempolicy mm/mempolicy.c:1510 [inline] __se_sys_set_mempolicy+0x44c/0xb60 mm/mempolicy.c:1507 __x64_sys_set_mempolicy+0xd8/0x110 mm/mempolicy.c:1507 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae KMSAN: uninit-value in mpol_rebind_task (2) https://syzkaller.appspot.com/bug?id=d6eb90f952c2a5de9ea718a1b873c55cb13b59dc This patch seems to fix below bug too. KMSAN: uninit-value in mpol_rebind_mm (2) https://syzkaller.appspot.com/bug?id=f2fecd0d7013f54ec4162f60743a2b28df40926b The uninit-value is pol->w.cpuset_mems_allowed in mpol_rebind_policy(). When syzkaller reproducer runs to the beginning of mpol_new(), mpol_new() mm/mempolicy.c do_mbind() mm/mempolicy.c kernel_mbind() mm/mempolicy.c `mode` is 1(MPOL_PREFERRED), nodes_empty(*nodes) is `true` and `flags` is 0. Then mode = MPOL_LOCAL; ... policy->mode = mode; policy->flags = flags; will be executed. So in mpol_set_nodemask(), mpol_set_nodemask() mm/mempolicy.c do_mbind() kernel_mbind() pol->mode is 4 (MPOL_LOCAL), that `nodemask` in `pol` is not initialized, which will be accessed in mpol_rebind_policy().
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 19:36 UTC
CWE
  • CWE-908 - Use of Uninitialized Resource
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7858d7bca7fbbbbd5b940d2ec371b2d060b21b84 , < 8c5429a04ccd8dbcc3c753dab2f4126774ec28d4 (git)
Affected: 7858d7bca7fbbbbd5b940d2ec371b2d060b21b84 , < 777e563f10e91e91130fe06bee85220d508e7b9b (git)
Affected: 7858d7bca7fbbbbd5b940d2ec371b2d060b21b84 , < 018160ad314d75b1409129b2247b614a9f35894c (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.15.58 , ≤ 5.15.* (semver)
Unaffected: 5.18.15 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49567",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:36:59.497396Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-908",
                "description": "CWE-908 Use of Uninitialized Resource",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:46:37.965Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/mempolicy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8c5429a04ccd8dbcc3c753dab2f4126774ec28d4",
              "status": "affected",
              "version": "7858d7bca7fbbbbd5b940d2ec371b2d060b21b84",
              "versionType": "git"
            },
            {
              "lessThan": "777e563f10e91e91130fe06bee85220d508e7b9b",
              "status": "affected",
              "version": "7858d7bca7fbbbbd5b940d2ec371b2d060b21b84",
              "versionType": "git"
            },
            {
              "lessThan": "018160ad314d75b1409129b2247b614a9f35894c",
              "status": "affected",
              "version": "7858d7bca7fbbbbd5b940d2ec371b2d060b21b84",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/mempolicy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.58",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.15",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/mempolicy: fix uninit-value in mpol_rebind_policy()\n\nmpol_set_nodemask()(mm/mempolicy.c) does not set up nodemask when\npol-\u003emode is MPOL_LOCAL.  Check pol-\u003emode before access\npol-\u003ew.cpuset_mems_allowed in mpol_rebind_policy()(mm/mempolicy.c).\n\nBUG: KMSAN: uninit-value in mpol_rebind_policy mm/mempolicy.c:352 [inline]\nBUG: KMSAN: uninit-value in mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368\n mpol_rebind_policy mm/mempolicy.c:352 [inline]\n mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368\n cpuset_change_task_nodemask kernel/cgroup/cpuset.c:1711 [inline]\n cpuset_attach+0x787/0x15e0 kernel/cgroup/cpuset.c:2278\n cgroup_migrate_execute+0x1023/0x1d20 kernel/cgroup/cgroup.c:2515\n cgroup_migrate kernel/cgroup/cgroup.c:2771 [inline]\n cgroup_attach_task+0x540/0x8b0 kernel/cgroup/cgroup.c:2804\n __cgroup1_procs_write+0x5cc/0x7a0 kernel/cgroup/cgroup-v1.c:520\n cgroup1_tasks_write+0x94/0xb0 kernel/cgroup/cgroup-v1.c:539\n cgroup_file_write+0x4c2/0x9e0 kernel/cgroup/cgroup.c:3852\n kernfs_fop_write_iter+0x66a/0x9f0 fs/kernfs/file.c:296\n call_write_iter include/linux/fs.h:2162 [inline]\n new_sync_write fs/read_write.c:503 [inline]\n vfs_write+0x1318/0x2030 fs/read_write.c:590\n ksys_write+0x28b/0x510 fs/read_write.c:643\n __do_sys_write fs/read_write.c:655 [inline]\n __se_sys_write fs/read_write.c:652 [inline]\n __x64_sys_write+0xdb/0x120 fs/read_write.c:652\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nUninit was created at:\n slab_post_alloc_hook mm/slab.h:524 [inline]\n slab_alloc_node mm/slub.c:3251 [inline]\n slab_alloc mm/slub.c:3259 [inline]\n kmem_cache_alloc+0x902/0x11c0 mm/slub.c:3264\n mpol_new mm/mempolicy.c:293 [inline]\n do_set_mempolicy+0x421/0xb70 mm/mempolicy.c:853\n kernel_set_mempolicy mm/mempolicy.c:1504 [inline]\n __do_sys_set_mempolicy mm/mempolicy.c:1510 [inline]\n __se_sys_set_mempolicy+0x44c/0xb60 mm/mempolicy.c:1507\n __x64_sys_set_mempolicy+0xd8/0x110 mm/mempolicy.c:1507\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n\nKMSAN: uninit-value in mpol_rebind_task (2)\nhttps://syzkaller.appspot.com/bug?id=d6eb90f952c2a5de9ea718a1b873c55cb13b59dc\n\nThis patch seems to fix below bug too.\nKMSAN: uninit-value in mpol_rebind_mm (2)\nhttps://syzkaller.appspot.com/bug?id=f2fecd0d7013f54ec4162f60743a2b28df40926b\n\nThe uninit-value is pol-\u003ew.cpuset_mems_allowed in mpol_rebind_policy().\nWhen syzkaller reproducer runs to the beginning of mpol_new(),\n\n\t    mpol_new() mm/mempolicy.c\n\t  do_mbind() mm/mempolicy.c\n\tkernel_mbind() mm/mempolicy.c\n\n`mode` is 1(MPOL_PREFERRED), nodes_empty(*nodes) is `true` and `flags`\nis 0. Then\n\n\tmode = MPOL_LOCAL;\n\t...\n\tpolicy-\u003emode = mode;\n\tpolicy-\u003eflags = flags;\n\nwill be executed. So in mpol_set_nodemask(),\n\n\t    mpol_set_nodemask() mm/mempolicy.c\n\t  do_mbind()\n\tkernel_mbind()\n\npol-\u003emode is 4 (MPOL_LOCAL), that `nodemask` in `pol` is not initialized,\nwhich will be accessed in mpol_rebind_policy()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:02:26.927Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8c5429a04ccd8dbcc3c753dab2f4126774ec28d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/777e563f10e91e91130fe06bee85220d508e7b9b"
        },
        {
          "url": "https://git.kernel.org/stable/c/018160ad314d75b1409129b2247b614a9f35894c"
        }
      ],
      "title": "mm/mempolicy: fix uninit-value in mpol_rebind_policy()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49567",
    "datePublished": "2025-02-26T02:23:12.222Z",
    "dateReserved": "2025-02-26T02:21:30.410Z",
    "dateUpdated": "2026-05-11T19:02:26.927Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49567",
      "date": "2026-09-17",
      "epss": "0.00277",
      "percentile": "0.20199"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49567\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:32.420\",\"lastModified\":\"2026-06-17T05:18:28.290\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/mempolicy: fix uninit-value in mpol_rebind_policy()\\n\\nmpol_set_nodemask()(mm/mempolicy.c) does not set up nodemask when\\npol-\u003emode is MPOL_LOCAL.  Check pol-\u003emode before access\\npol-\u003ew.cpuset_mems_allowed in mpol_rebind_policy()(mm/mempolicy.c).\\n\\nBUG: KMSAN: uninit-value in mpol_rebind_policy mm/mempolicy.c:352 [inline]\\nBUG: KMSAN: uninit-value in mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368\\n mpol_rebind_policy mm/mempolicy.c:352 [inline]\\n mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368\\n cpuset_change_task_nodemask kernel/cgroup/cpuset.c:1711 [inline]\\n cpuset_attach+0x787/0x15e0 kernel/cgroup/cpuset.c:2278\\n cgroup_migrate_execute+0x1023/0x1d20 kernel/cgroup/cgroup.c:2515\\n cgroup_migrate kernel/cgroup/cgroup.c:2771 [inline]\\n cgroup_attach_task+0x540/0x8b0 kernel/cgroup/cgroup.c:2804\\n __cgroup1_procs_write+0x5cc/0x7a0 kernel/cgroup/cgroup-v1.c:520\\n cgroup1_tasks_write+0x94/0xb0 kernel/cgroup/cgroup-v1.c:539\\n cgroup_file_write+0x4c2/0x9e0 kernel/cgroup/cgroup.c:3852\\n kernfs_fop_write_iter+0x66a/0x9f0 fs/kernfs/file.c:296\\n call_write_iter include/linux/fs.h:2162 [inline]\\n new_sync_write fs/read_write.c:503 [inline]\\n vfs_write+0x1318/0x2030 fs/read_write.c:590\\n ksys_write+0x28b/0x510 fs/read_write.c:643\\n __do_sys_write fs/read_write.c:655 [inline]\\n __se_sys_write fs/read_write.c:652 [inline]\\n __x64_sys_write+0xdb/0x120 fs/read_write.c:652\\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\\n do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82\\n entry_SYSCALL_64_after_hwframe+0x44/0xae\\n\\nUninit was created at:\\n slab_post_alloc_hook mm/slab.h:524 [inline]\\n slab_alloc_node mm/slub.c:3251 [inline]\\n slab_alloc mm/slub.c:3259 [inline]\\n kmem_cache_alloc+0x902/0x11c0 mm/slub.c:3264\\n mpol_new mm/mempolicy.c:293 [inline]\\n do_set_mempolicy+0x421/0xb70 mm/mempolicy.c:853\\n kernel_set_mempolicy mm/mempolicy.c:1504 [inline]\\n __do_sys_set_mempolicy mm/mempolicy.c:1510 [inline]\\n __se_sys_set_mempolicy+0x44c/0xb60 mm/mempolicy.c:1507\\n __x64_sys_set_mempolicy+0xd8/0x110 mm/mempolicy.c:1507\\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\\n do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82\\n entry_SYSCALL_64_after_hwframe+0x44/0xae\\n\\nKMSAN: uninit-value in mpol_rebind_task (2)\\nhttps://syzkaller.appspot.com/bug?id=d6eb90f952c2a5de9ea718a1b873c55cb13b59dc\\n\\nThis patch seems to fix below bug too.\\nKMSAN: uninit-value in mpol_rebind_mm (2)\\nhttps://syzkaller.appspot.com/bug?id=f2fecd0d7013f54ec4162f60743a2b28df40926b\\n\\nThe uninit-value is pol-\u003ew.cpuset_mems_allowed in mpol_rebind_policy().\\nWhen syzkaller reproducer runs to the beginning of mpol_new(),\\n\\n\\t    mpol_new() mm/mempolicy.c\\n\\t  do_mbind() mm/mempolicy.c\\n\\tkernel_mbind() mm/mempolicy.c\\n\\n`mode` is 1(MPOL_PREFERRED), nodes_empty(*nodes) is `true` and `flags`\\nis 0. Then\\n\\n\\tmode = MPOL_LOCAL;\\n\\t...\\n\\tpolicy-\u003emode = mode;\\n\\tpolicy-\u003eflags = flags;\\n\\nwill be executed. So in mpol_set_nodemask(),\\n\\n\\t    mpol_set_nodemask() mm/mempolicy.c\\n\\t  do_mbind()\\n\\tkernel_mbind()\\n\\npol-\u003emode is 4 (MPOL_LOCAL), that `nodemask` in `pol` is not initialized,\\nwhich will be accessed in mpol_rebind_policy().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/mempolicy: fix uninit-value in mpol_rebind_policy() mpol_set_nodemask()(mm/mempolicy.c) does not set up nodemask when pol-\u0026gt;mode is MPOL_LOCAL. Check pol-\u0026gt;mode before access pol-\u0026gt;w.cpuset_mems_allowed in mpol_rebind_policy()(mm/mempolicy.c). BUG: KMSAN: uninit-value in mpol_rebind_policy mm/mempolicy.c:352 [inline] BUG: KMSAN: uninit-value in mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368 mpol_rebind_policy mm/mempolicy.c:352 [inline] mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368 cpuset_change_task_nodemask kernel/cgroup/cpuset.c:1711 [inline] cpuset_attach+0x787/0x15e0 kernel/cgroup/cpuset.c:2278 cgroup_migrate_execute+0x1023/0x1d20 kernel/cgroup/cgroup.c:2515 cgroup_migrate kernel/cgroup/cgroup.c:2771 [inline] cgroup_attach_task+0x540/0x8b0 kernel/cgroup/cgroup.c:2804 __cgroup1_procs_write+0x5cc/0x7a0 kernel/cgroup/cgroup-v1.c:520 cgroup1_tasks_write+0x94/0xb0 kernel/cgroup/cgroup-v1.c:539 cgroup_file_write+0x4c2/0x9e0 kernel/cgroup/cgroup.c:3852 kernfs_fop_write_iter+0x66a/0x9f0 fs/kernfs/file.c:296 call_write_iter include/linux/fs.h:2162 [inline] new_sync_write fs/read_write.c:503 [inline] vfs_write+0x1318/0x2030 fs/read_write.c:590 ksys_write+0x28b/0x510 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0xdb/0x120 fs/read_write.c:652 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] slab_alloc mm/slub.c:3259 [inline] kmem_cache_alloc+0x902/0x11c0 mm/slub.c:3264 mpol_new mm/mempolicy.c:293 [inline] do_set_mempolicy+0x421/0xb70 mm/mempolicy.c:853 kernel_set_mempolicy mm/mempolicy.c:1504 [inline] __do_sys_set_mempolicy mm/mempolicy.c:1510 [inline] __se_sys_set_mempolicy+0x44c/0xb60 mm/mempolicy.c:1507 __x64_sys_set_mempolicy+0xd8/0x110 mm/mempolicy.c:1507 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae KMSAN: uninit-value in mpol_rebind_task (2) https://syzkaller.appspot.com/bug?id=d6eb90f952c2a5de9ea718a1b873c55cb13b59dc This patch seems to fix below bug too. KMSAN: uninit-value in mpol_rebind_mm (2) https://syzkaller.appspot.com/bug?id=f2fecd0d7013f54ec4162f60743a2b28df40926b The uninit-value is pol-\u0026gt;w.cpuset_mems_allowed in mpol_rebind_policy(). When syzkaller reproducer runs to the beginning of mpol_new(), mpol_new() mm/mempolicy.c do_mbind() mm/mempolicy.c kernel_mbind() mm/mempolicy.c `mode` is 1(MPOL_PREFERRED), nodes_empty(*nodes) is `true` and `flags` is 0. Then mode = MPOL_LOCAL; ... policy-\u0026gt;mode = mode; policy-\u0026gt;flags = flags; will be executed. So in mpol_set_nodemask(), mpol_set_nodemask() mm/mempolicy.c do_mbind() kernel_mbind() pol-\u0026gt;mode is 4 (MPOL_LOCAL), that `nodemask` in `pol` is not initialized, which will be accessed in mpol_rebind_policy(). \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"mm/mempolicy.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7858d7bca7fbbbbd5b940d2ec371b2d060b21b84\",\"lessThan\":\"8c5429a04ccd8dbcc3c753dab2f4126774ec28d4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7858d7bca7fbbbbd5b940d2ec371b2d060b21b84\",\"lessThan\":\"777e563f10e91e91130fe06bee85220d508e7b9b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7858d7bca7fbbbbd5b940d2ec371b2d060b21b84\",\"lessThan\":\"018160ad314d75b1409129b2247b614a9f35894c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"mm/mempolicy.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.58\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18.15\",\"lessThanOrEqual\":\"5.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:36:59.497396Z\",\"id\":\"CVE-2022-49567\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-908\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-908\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.9.325\",\"matchCriteriaId\":\"6FD0FC1F-AC56-4EF7-8913-24FBB31FDFA6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10\",\"versionEndExcluding\":\"4.14.290\",\"matchCriteriaId\":\"1F023E37-5DAE-491D-9971-00FC089E8C7E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.254\",\"matchCriteriaId\":\"56D38C39-4EB7-48A7-85D3-D4854AC7B3E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.208\",\"matchCriteriaId\":\"58A5EC97-5FF0-4B0A-8074-2A5A57644D59\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.134\",\"matchCriteriaId\":\"4B697B47-6B36-47E0-95DC-054EC4633DEA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.58\",\"matchCriteriaId\":\"13CF20C8-4DA9-4A21-AD13-7A5C22E5FB05\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.18.15\",\"matchCriteriaId\":\"EAD6B571-194C-43A2-A4AB-F68F869D13BC\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/018160ad314d75b1409129b2247b614a9f35894c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/777e563f10e91e91130fe06bee85220d508e7b9b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8c5429a04ccd8dbcc3c753dab2f4126774ec28d4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-21T18:43:23+00:00",
      "cve": "CVE-2022-49567",
      "id": "CVE-2022-49567",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm/mempolicy: fix uninit-value in mpol_rebind_policy()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49567.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T02:27:21Z",
      "cve": "CVE-2022-49567",
      "id": "CVE-2022-49567",
      "initial_release_date": "2025-02-27T03:04:54Z",
      "product_status:known_affected": "392",
      "product_status:known_not_affected": "75",
      "product_status:recommended": "29",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49567",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49567.json",
      "version": "26"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-49567\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:36:59.497396Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-908\", \"description\": \"CWE-908 Use of Uninitialized Resource\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T16:50:11.785Z\"}}], \"cna\": {\"title\": \"mm/mempolicy: fix uninit-value in mpol_rebind_policy()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7858d7bca7fbbbbd5b940d2ec371b2d060b21b84\", \"lessThan\": \"8c5429a04ccd8dbcc3c753dab2f4126774ec28d4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7858d7bca7fbbbbd5b940d2ec371b2d060b21b84\", \"lessThan\": \"777e563f10e91e91130fe06bee85220d508e7b9b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7858d7bca7fbbbbd5b940d2ec371b2d060b21b84\", \"lessThan\": \"018160ad314d75b1409129b2247b614a9f35894c\", \"versionType\": \"git\"}], \"programFiles\": [\"mm/mempolicy.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.14\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.14\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.58\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.18.15\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.18.*\"}, {\"status\": \"unaffected\", \"version\": \"5.19\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"mm/mempolicy.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8c5429a04ccd8dbcc3c753dab2f4126774ec28d4\"}, {\"url\": \"https://git.kernel.org/stable/c/777e563f10e91e91130fe06bee85220d508e7b9b\"}, {\"url\": \"https://git.kernel.org/stable/c/018160ad314d75b1409129b2247b614a9f35894c\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm/mempolicy: fix uninit-value in mpol_rebind_policy()\\n\\nmpol_set_nodemask()(mm/mempolicy.c) does not set up nodemask when\\npol-\u003emode is MPOL_LOCAL.  Check pol-\u003emode before access\\npol-\u003ew.cpuset_mems_allowed in mpol_rebind_policy()(mm/mempolicy.c).\\n\\nBUG: KMSAN: uninit-value in mpol_rebind_policy mm/mempolicy.c:352 [inline]\\nBUG: KMSAN: uninit-value in mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368\\n mpol_rebind_policy mm/mempolicy.c:352 [inline]\\n mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368\\n cpuset_change_task_nodemask kernel/cgroup/cpuset.c:1711 [inline]\\n cpuset_attach+0x787/0x15e0 kernel/cgroup/cpuset.c:2278\\n cgroup_migrate_execute+0x1023/0x1d20 kernel/cgroup/cgroup.c:2515\\n cgroup_migrate kernel/cgroup/cgroup.c:2771 [inline]\\n cgroup_attach_task+0x540/0x8b0 kernel/cgroup/cgroup.c:2804\\n __cgroup1_procs_write+0x5cc/0x7a0 kernel/cgroup/cgroup-v1.c:520\\n cgroup1_tasks_write+0x94/0xb0 kernel/cgroup/cgroup-v1.c:539\\n cgroup_file_write+0x4c2/0x9e0 kernel/cgroup/cgroup.c:3852\\n kernfs_fop_write_iter+0x66a/0x9f0 fs/kernfs/file.c:296\\n call_write_iter include/linux/fs.h:2162 [inline]\\n new_sync_write fs/read_write.c:503 [inline]\\n vfs_write+0x1318/0x2030 fs/read_write.c:590\\n ksys_write+0x28b/0x510 fs/read_write.c:643\\n __do_sys_write fs/read_write.c:655 [inline]\\n __se_sys_write fs/read_write.c:652 [inline]\\n __x64_sys_write+0xdb/0x120 fs/read_write.c:652\\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\\n do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82\\n entry_SYSCALL_64_after_hwframe+0x44/0xae\\n\\nUninit was created at:\\n slab_post_alloc_hook mm/slab.h:524 [inline]\\n slab_alloc_node mm/slub.c:3251 [inline]\\n slab_alloc mm/slub.c:3259 [inline]\\n kmem_cache_alloc+0x902/0x11c0 mm/slub.c:3264\\n mpol_new mm/mempolicy.c:293 [inline]\\n do_set_mempolicy+0x421/0xb70 mm/mempolicy.c:853\\n kernel_set_mempolicy mm/mempolicy.c:1504 [inline]\\n __do_sys_set_mempolicy mm/mempolicy.c:1510 [inline]\\n __se_sys_set_mempolicy+0x44c/0xb60 mm/mempolicy.c:1507\\n __x64_sys_set_mempolicy+0xd8/0x110 mm/mempolicy.c:1507\\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\\n do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82\\n entry_SYSCALL_64_after_hwframe+0x44/0xae\\n\\nKMSAN: uninit-value in mpol_rebind_task (2)\\nhttps://syzkaller.appspot.com/bug?id=d6eb90f952c2a5de9ea718a1b873c55cb13b59dc\\n\\nThis patch seems to fix below bug too.\\nKMSAN: uninit-value in mpol_rebind_mm (2)\\nhttps://syzkaller.appspot.com/bug?id=f2fecd0d7013f54ec4162f60743a2b28df40926b\\n\\nThe uninit-value is pol-\u003ew.cpuset_mems_allowed in mpol_rebind_policy().\\nWhen syzkaller reproducer runs to the beginning of mpol_new(),\\n\\n\\t    mpol_new() mm/mempolicy.c\\n\\t  do_mbind() mm/mempolicy.c\\n\\tkernel_mbind() mm/mempolicy.c\\n\\n`mode` is 1(MPOL_PREFERRED), nodes_empty(*nodes) is `true` and `flags`\\nis 0. Then\\n\\n\\tmode = MPOL_LOCAL;\\n\\t...\\n\\tpolicy-\u003emode = mode;\\n\\tpolicy-\u003eflags = flags;\\n\\nwill be executed. So in mpol_set_nodemask(),\\n\\n\\t    mpol_set_nodemask() mm/mempolicy.c\\n\\t  do_mbind()\\n\\tkernel_mbind()\\n\\npol-\u003emode is 4 (MPOL_LOCAL), that `nodemask` in `pol` is not initialized,\\nwhich will be accessed in mpol_rebind_policy().\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.58\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.18.15\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.19\", \"versionStartIncluding\": \"5.14\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T19:02:26.927Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-49567\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T19:02:26.927Z\", \"dateReserved\": \"2025-02-26T02:21:30.410Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-26T02:23:12.222Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.