CVE-2022-49948 (GCVE-0-2022-49948)

Vulnerability from cvelistv5 – Published: 2025-06-18 11:00 – Updated: 2026-08-05 08:56
VLAI
Title
vt: Clear selection before changing the font
Summary
In the Linux kernel, the following vulnerability has been resolved: vt: Clear selection before changing the font When changing the console font with ioctl(KDFONTOP) the new font size can be bigger than the previous font. A previous selection may thus now be outside of the new screen size and thus trigger out-of-bounds accesses to graphics memory if the selection is removed in vc_do_resize(). Prevent such out-of-memory accesses by dropping the selection before the various con_font_set() console handlers are called.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 009e39ae44f4191188aeb6dfbf661b771dbbe515 , < c555cf04684fde39b5b0dd9fd80730030ee10c4a (git)
Affected: 009e39ae44f4191188aeb6dfbf661b771dbbe515 , < e9ba4611ddf676194385506222cce7b0844e708e (git)
Affected: 009e39ae44f4191188aeb6dfbf661b771dbbe515 , < f74b4a41c5d7c9522469917e3072e55d435efd9e (git)
Affected: 009e39ae44f4191188aeb6dfbf661b771dbbe515 , < 1cf1930369c9dc428d827b60260c53271bff3285 (git)
Affected: 009e39ae44f4191188aeb6dfbf661b771dbbe515 , < 989201bb8c00b222235aff04e6200230d29dc7bb (git)
Affected: 009e39ae44f4191188aeb6dfbf661b771dbbe515 , < 2535431ae967ad17585513649625fea7db28d4db (git)
Affected: 009e39ae44f4191188aeb6dfbf661b771dbbe515 , < c904fe03c4bd1f356a58797d39e2a5d0ca15cefc (git)
Affected: 009e39ae44f4191188aeb6dfbf661b771dbbe515 , < 566f9c9f89337792070b5a6062dff448b3e7977f (git)
Affected: e60f8fcce05042e8f8cea25ee81fecc1222114cf (git)
Affected: 5812a9bc9d68a82c2cc839f88e6f7a05093ab39d (git)
Affected: 863ad19fd654c485e3beec3575c4d74a1e74369e (git)
Affected: dbc3fd44f957a39407e889287bf61fa0ef3ecc14 (git)
Affected: 0b2a0a58ad22f9d6dfc641bc5ec46057493f22a5 (git)
Affected: 9f2d48f0745f921040df91bfe8fa7f0339cd7497 (git)
Affected: 3425e397fb23cc2e8e6fb8f5b8226dcb447e84dd (git)
Affected: eeae0a12a16650ff494d5faefa371cd9e7079575 (git)
Affected: 3.2.85 , < 3.3 (semver)
Affected: 3.10.105 , < 3.11 (semver)
Affected: 3.12.68 , < 3.13 (semver)
Affected: 3.16.40 , < 3.17 (semver)
Affected: 3.18.45 , < 3.19 (semver)
Affected: 4.1.36 , < 4.2 (semver)
Affected: 4.4.31 , < 4.5 (semver)
Affected: 4.8.7 , < 4.9 (semver)
Create a notification for this product.
Linux Linux Affected: 4.9
Unaffected: 0 , < 4.9 (semver)
Unaffected: 4.9.328 , ≤ 4.9.* (semver)
Unaffected: 4.14.293 , ≤ 4.14.* (semver)
Unaffected: 4.19.258 , ≤ 4.19.* (semver)
Unaffected: 5.4.213 , ≤ 5.4.* (semver)
Unaffected: 5.10.142 , ≤ 5.10.* (semver)
Unaffected: 5.15.66 , ≤ 5.15.* (semver)
Unaffected: 5.19.8 , ≤ 5.19.* (semver)
Unaffected: 6.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/vt/vt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c555cf04684fde39b5b0dd9fd80730030ee10c4a",
              "status": "affected",
              "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515",
              "versionType": "git"
            },
            {
              "lessThan": "e9ba4611ddf676194385506222cce7b0844e708e",
              "status": "affected",
              "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515",
              "versionType": "git"
            },
            {
              "lessThan": "f74b4a41c5d7c9522469917e3072e55d435efd9e",
              "status": "affected",
              "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515",
              "versionType": "git"
            },
            {
              "lessThan": "1cf1930369c9dc428d827b60260c53271bff3285",
              "status": "affected",
              "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515",
              "versionType": "git"
            },
            {
              "lessThan": "989201bb8c00b222235aff04e6200230d29dc7bb",
              "status": "affected",
              "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515",
              "versionType": "git"
            },
            {
              "lessThan": "2535431ae967ad17585513649625fea7db28d4db",
              "status": "affected",
              "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515",
              "versionType": "git"
            },
            {
              "lessThan": "c904fe03c4bd1f356a58797d39e2a5d0ca15cefc",
              "status": "affected",
              "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515",
              "versionType": "git"
            },
            {
              "lessThan": "566f9c9f89337792070b5a6062dff448b3e7977f",
              "status": "affected",
              "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e60f8fcce05042e8f8cea25ee81fecc1222114cf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5812a9bc9d68a82c2cc839f88e6f7a05093ab39d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "863ad19fd654c485e3beec3575c4d74a1e74369e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dbc3fd44f957a39407e889287bf61fa0ef3ecc14",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0b2a0a58ad22f9d6dfc641bc5ec46057493f22a5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9f2d48f0745f921040df91bfe8fa7f0339cd7497",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3425e397fb23cc2e8e6fb8f5b8226dcb447e84dd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "eeae0a12a16650ff494d5faefa371cd9e7079575",
              "versionType": "git"
            },
            {
              "lessThan": "3.3",
              "status": "affected",
              "version": "3.2.85",
              "versionType": "semver"
            },
            {
              "lessThan": "3.11",
              "status": "affected",
              "version": "3.10.105",
              "versionType": "semver"
            },
            {
              "lessThan": "3.13",
              "status": "affected",
              "version": "3.12.68",
              "versionType": "semver"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.40",
              "versionType": "semver"
            },
            {
              "lessThan": "3.19",
              "status": "affected",
              "version": "3.18.45",
              "versionType": "semver"
            },
            {
              "lessThan": "4.2",
              "status": "affected",
              "version": "4.1.36",
              "versionType": "semver"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.31",
              "versionType": "semver"
            },
            {
              "lessThan": "4.9",
              "status": "affected",
              "version": "4.8.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/vt/vt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.328",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.293",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.213",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.328",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.293",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.258",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.213",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.142",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.66",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.8",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.2.85",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.10.105",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.12.68",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.16.40",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.18.45",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.1.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.8.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvt: Clear selection before changing the font\n\nWhen changing the console font with ioctl(KDFONTOP) the new font size\ncan be bigger than the previous font. A previous selection may thus now\nbe outside of the new screen size and thus trigger out-of-bounds\naccesses to graphics memory if the selection is removed in\nvc_do_resize().\n\nPrevent such out-of-memory accesses by dropping the selection before the\nvarious con_font_set() console handlers are called."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local ioctl access to a virtual terminal device (KDFONTOP and TIOCLINUX), not network or adjacent-network reachability.\nAC:L - The attacker fully controls both prerequisites\u2014setting a console selection and changing the font to a larger size\u2014so the out-of-bounds write in imageblit can be triggered reliably without depending on external conditions.\nPR:L - KDFONTOP SET and TIOCL_SETSEL are permitted to the unprivileged owner of the controlling VT (current-\u003esignal-\u003etty == tty); CAP_SYS_TTY_CONFIG/CAP_SYS_ADMIN are not required, matching other VT/fbcon scores.\nUI:N - The attacker performs the ioctls directly on their own VT session; no separate victim action is required.\nS:U - Impact is confined to the host kernel authority (memory corruption / DoS); there is no VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - The bug is a confirmed out-of-bounds write (stack and vmalloc) via imageblit; per kernel CVSS guidance, such memory corruption can be leveraged for arbitrary disclosure primitives.\nI:H - Out-of-bounds writes past the framebuffer and into stack/adjacent memory enable corruption exploitable for control-flow hijacking, consistent with similar fast_imageblit/fbcon OOB-write CVEs.\nA:H - Triggering the path causes kernel KASAN reports and oopses (vmalloc/stack out-of-bounds in imageblit), which is a High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:56:50.380Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c555cf04684fde39b5b0dd9fd80730030ee10c4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/e9ba4611ddf676194385506222cce7b0844e708e"
        },
        {
          "url": "https://git.kernel.org/stable/c/f74b4a41c5d7c9522469917e3072e55d435efd9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/1cf1930369c9dc428d827b60260c53271bff3285"
        },
        {
          "url": "https://git.kernel.org/stable/c/989201bb8c00b222235aff04e6200230d29dc7bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/2535431ae967ad17585513649625fea7db28d4db"
        },
        {
          "url": "https://git.kernel.org/stable/c/c904fe03c4bd1f356a58797d39e2a5d0ca15cefc"
        },
        {
          "url": "https://git.kernel.org/stable/c/566f9c9f89337792070b5a6062dff448b3e7977f"
        }
      ],
      "title": "vt: Clear selection before changing the font",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49948",
    "datePublished": "2025-06-18T11:00:12.364Z",
    "dateReserved": "2025-06-18T10:57:27.382Z",
    "dateUpdated": "2026-08-05T08:56:50.380Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49948",
      "date": "2026-08-06",
      "epss": "0.00225",
      "percentile": "0.13263"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49948\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-06-18T11:15:21.827\",\"lastModified\":\"2026-08-04T10:18:00.577\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvt: Clear selection before changing the font\\n\\nWhen changing the console font with ioctl(KDFONTOP) the new font size\\ncan be bigger than the previous font. A previous selection may thus now\\nbe outside of the new screen size and thus trigger out-of-bounds\\naccesses to graphics memory if the selection is removed in\\nvc_do_resize().\\n\\nPrevent such out-of-memory accesses by dropping the selection before the\\nvarious con_font_set() console handlers are called.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: vt: Borrar la selecci\u00f3n antes de cambiar la fuente. Al cambiar la fuente de la consola con ioctl(KDFONTOP), el nuevo tama\u00f1o de fuente puede ser mayor que el anterior. Por lo tanto, una selecci\u00f3n anterior podr\u00eda quedar fuera del nuevo tama\u00f1o de pantalla y, por lo tanto, provocar accesos fuera de los l\u00edmites a la memoria gr\u00e1fica si se elimina la selecci\u00f3n en vc_do_resize(). Para evitar estos accesos fuera de memoria, elimine la selecci\u00f3n antes de llamar a los controladores de consola con_font_set().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/tty/vt/vt.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"009e39ae44f4191188aeb6dfbf661b771dbbe515\",\"lessThan\":\"c555cf04684fde39b5b0dd9fd80730030ee10c4a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"009e39ae44f4191188aeb6dfbf661b771dbbe515\",\"lessThan\":\"e9ba4611ddf676194385506222cce7b0844e708e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"009e39ae44f4191188aeb6dfbf661b771dbbe515\",\"lessThan\":\"f74b4a41c5d7c9522469917e3072e55d435efd9e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"009e39ae44f4191188aeb6dfbf661b771dbbe515\",\"lessThan\":\"1cf1930369c9dc428d827b60260c53271bff3285\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"009e39ae44f4191188aeb6dfbf661b771dbbe515\",\"lessThan\":\"989201bb8c00b222235aff04e6200230d29dc7bb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"009e39ae44f4191188aeb6dfbf661b771dbbe515\",\"lessThan\":\"2535431ae967ad17585513649625fea7db28d4db\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"009e39ae44f4191188aeb6dfbf661b771dbbe515\",\"lessThan\":\"c904fe03c4bd1f356a58797d39e2a5d0ca15cefc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"009e39ae44f4191188aeb6dfbf661b771dbbe515\",\"lessThan\":\"566f9c9f89337792070b5a6062dff448b3e7977f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e60f8fcce05042e8f8cea25ee81fecc1222114cf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5812a9bc9d68a82c2cc839f88e6f7a05093ab39d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"863ad19fd654c485e3beec3575c4d74a1e74369e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dbc3fd44f957a39407e889287bf61fa0ef3ecc14\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0b2a0a58ad22f9d6dfc641bc5ec46057493f22a5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9f2d48f0745f921040df91bfe8fa7f0339cd7497\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3425e397fb23cc2e8e6fb8f5b8226dcb447e84dd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eeae0a12a16650ff494d5faefa371cd9e7079575\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3.2.85\",\"lessThan\":\"3.3\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.10.105\",\"lessThan\":\"3.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.12.68\",\"lessThan\":\"3.13\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.16.40\",\"lessThan\":\"3.17\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.18.45\",\"lessThan\":\"3.19\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.1.36\",\"lessThan\":\"4.2\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.4.31\",\"lessThan\":\"4.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.8.7\",\"lessThan\":\"4.9\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/tty/vt/vt.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.9.328\",\"lessThanOrEqual\":\"4.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.293\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.258\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.213\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.142\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.66\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19.8\",\"lessThanOrEqual\":\"5.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.9.328\",\"matchCriteriaId\":\"82C9EA22-96BE-488C-A979-0A1FBD90A0AE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10\",\"versionEndExcluding\":\"4.14.293\",\"matchCriteriaId\":\"5D9B742D-912D-4E0C-A42F-367086FDEA88\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.258\",\"matchCriteriaId\":\"253D30F5-3734-4663-883A-288786D3B66E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.213\",\"matchCriteriaId\":\"4C373116-9E23-44BA-A6B7-87C8BF5C3B85\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.142\",\"matchCriteriaId\":\"D44AD643-5591-432E-BD41-C2C737F54AC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.66\",\"matchCriteriaId\":\"52AE7E2B-7BE3-4B8A-89CC-AB62434899A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.19.8\",\"matchCriteriaId\":\"7FEC7656-4CE2-424C-8830-EDB160E701C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E8BD11A3-8643-49B6-BADE-5029A0117325\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F0AD220-F6A9-4012-8636-155F1B841FAD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"A46498B3-78E1-4623-AAE1-94D29A42BE4E\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1cf1930369c9dc428d827b60260c53271bff3285\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2535431ae967ad17585513649625fea7db28d4db\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/566f9c9f89337792070b5a6062dff448b3e7977f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/989201bb8c00b222235aff04e6200230d29dc7bb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c555cf04684fde39b5b0dd9fd80730030ee10c4a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c904fe03c4bd1f356a58797d39e2a5d0ca15cefc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e9ba4611ddf676194385506222cce7b0844e708e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f74b4a41c5d7c9522469917e3072e55d435efd9e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:42:21+00:00",
      "cve": "CVE-2022-49948",
      "id": "CVE-2022-49948",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: vt: Clear selection before changing the font",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49948.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T01:12:11Z",
      "cve": "CVE-2022-49948",
      "id": "CVE-2022-49948",
      "initial_release_date": "2025-06-19T03:45:50Z",
      "product_status:known_affected": "429",
      "product_status:known_not_affected": "196",
      "product_status:recommended": "310",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49948",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49948.json",
      "version": "55"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.