CVE-2022-50630 (GCVE-0-2022-50630)

Vulnerability from cvelistv5 – Published: 2025-12-08 01:16 – Updated: 2026-08-05 08:59
VLAI
Title
mm: hugetlb: fix UAF in hugetlb_handle_userfault
Summary
In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: fix UAF in hugetlb_handle_userfault The vma_lock and hugetlb_fault_mutex are dropped before handling userfault and reacquire them again after handle_userfault(), but reacquire the vma_lock could lead to UAF[1,2] due to the following race, hugetlb_fault hugetlb_no_page /*unlock vma_lock */ hugetlb_handle_userfault handle_userfault /* unlock mm->mmap_lock*/ vm_mmap_pgoff do_mmap mmap_region munmap_vma_range /* clean old vma */ /* lock vma_lock again <--- UAF */ /* unlock vma_lock */ Since the vma_lock will unlock immediately after hugetlb_handle_userfault(), let's drop the unneeded lock and unlock in hugetlb_handle_userfault() to fix the issue. [1] https://lore.kernel.org/linux-mm/000000000000d5e00a05e834962e@google.com/ [2] https://lore.kernel.org/linux-mm/20220921014457.1668-1-liuzixian4@huawei.com/
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1a1aad8a9b7bd34f60cdf98cd7915f00ae892c45 , < 45c33966759ea1b4040c08dacda99ef623c0ca29 (git)
Affected: 1a1aad8a9b7bd34f60cdf98cd7915f00ae892c45 , < 0db2efb3bff879566f05341d94c3de00ac95c4cc (git)
Affected: 1a1aad8a9b7bd34f60cdf98cd7915f00ae892c45 , < dd691973f67b2800a97db723b1ff6f07fdcf7f5a (git)
Affected: 1a1aad8a9b7bd34f60cdf98cd7915f00ae892c45 , < 78504bcedb2f1bbfb353b4d233c24d641c4dda33 (git)
Affected: 1a1aad8a9b7bd34f60cdf98cd7915f00ae892c45 , < 958f32ce832ba781ac20e11bb2d12a9352ea28fc (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.11
Unaffected: 0 , < 4.11 (semver)
Unaffected: 5.10.150 , ≤ 5.10.* (semver)
Unaffected: 5.15.75 , ≤ 5.15.* (semver)
Unaffected: 5.19.17 , ≤ 5.19.* (semver)
Unaffected: 6.0.3 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/hugetlb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "45c33966759ea1b4040c08dacda99ef623c0ca29",
              "status": "affected",
              "version": "1a1aad8a9b7bd34f60cdf98cd7915f00ae892c45",
              "versionType": "git"
            },
            {
              "lessThan": "0db2efb3bff879566f05341d94c3de00ac95c4cc",
              "status": "affected",
              "version": "1a1aad8a9b7bd34f60cdf98cd7915f00ae892c45",
              "versionType": "git"
            },
            {
              "lessThan": "dd691973f67b2800a97db723b1ff6f07fdcf7f5a",
              "status": "affected",
              "version": "1a1aad8a9b7bd34f60cdf98cd7915f00ae892c45",
              "versionType": "git"
            },
            {
              "lessThan": "78504bcedb2f1bbfb353b4d233c24d641c4dda33",
              "status": "affected",
              "version": "1a1aad8a9b7bd34f60cdf98cd7915f00ae892c45",
              "versionType": "git"
            },
            {
              "lessThan": "958f32ce832ba781ac20e11bb2d12a9352ea28fc",
              "status": "affected",
              "version": "1a1aad8a9b7bd34f60cdf98cd7915f00ae892c45",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/hugetlb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.150",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.150",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.75",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.17",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.3",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: hugetlb: fix UAF in hugetlb_handle_userfault\n\nThe vma_lock and hugetlb_fault_mutex are dropped before handling userfault\nand reacquire them again after handle_userfault(), but reacquire the\nvma_lock could lead to UAF[1,2] due to the following race,\n\nhugetlb_fault\n  hugetlb_no_page\n    /*unlock vma_lock */\n    hugetlb_handle_userfault\n      handle_userfault\n        /* unlock mm-\u003emmap_lock*/\n                                           vm_mmap_pgoff\n                                             do_mmap\n                                               mmap_region\n                                                 munmap_vma_range\n                                                   /* clean old vma */\n        /* lock vma_lock again  \u003c--- UAF */\n    /* unlock vma_lock */\n\nSince the vma_lock will unlock immediately after\nhugetlb_handle_userfault(), let\u0027s drop the unneeded lock and unlock in\nhugetlb_handle_userfault() to fix the issue.\n\n[1] https://lore.kernel.org/linux-mm/000000000000d5e00a05e834962e@google.com/\n[2] https://lore.kernel.org/linux-mm/20220921014457.1668-1-liuzixian4@huawei.com/"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local syscalls (MAP_HUGETLB mmap, userfaultfd register, and a page fault into hugetlb_fault\u2192hugetlb_no_page\u2192hugetlb_handle_userfault); it is not reachable via network packet processing.\nAC:L - The attacker controls both sides of the race\u2014one thread sleeps in handle_userfault after mmap_lock is dropped while another thread munmaps/remaps the same range\u2014creating a large, attacker-driven window to free the VMA/inode before the pointless re-lock.\nPR:L - An unprivileged user can open userfaultfd with UFFD_USER_MODE_ONLY (always allowed) and create hugetlb mappings via MAP_HUGETLB (HUGETLB_ANONHUGE_INODE bypasses the CAP_IPC_LOCK/shm_group check used only for SHM_HUGETLB).\nUI:N - The attacker triggers the fault and concurrent munmap/remap entirely within their own process; no victim action is required.\nS:U - This is a standard in-kernel memory-management UAF that affects the same host kernel privilege boundary, not a VM escape or cross-authority boundary crossing.\nC:H - The UAF is on a freed hugetlbfs_inode slab object (RCU-delayed free), which can be reclaimed and controlled to obtain an arbitrary kernel read primitive.\nI:H - A controllable slab UAF on the hugetlbfs inode enables heap spraying and an arbitrary write / control-flow hijack primitive for privilege escalation.\nA:H - The demonstrated KASAN use-after-free read causes a kernel oops/crash, and any failed exploit attempt can panic or hang the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:59:13.840Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/45c33966759ea1b4040c08dacda99ef623c0ca29"
        },
        {
          "url": "https://git.kernel.org/stable/c/0db2efb3bff879566f05341d94c3de00ac95c4cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd691973f67b2800a97db723b1ff6f07fdcf7f5a"
        },
        {
          "url": "https://git.kernel.org/stable/c/78504bcedb2f1bbfb353b4d233c24d641c4dda33"
        },
        {
          "url": "https://git.kernel.org/stable/c/958f32ce832ba781ac20e11bb2d12a9352ea28fc"
        }
      ],
      "title": "mm: hugetlb: fix UAF in hugetlb_handle_userfault",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50630",
    "datePublished": "2025-12-08T01:16:45.555Z",
    "dateReserved": "2025-12-08T01:14:55.192Z",
    "dateUpdated": "2026-08-05T08:59:13.840Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50630",
      "date": "2026-09-27",
      "epss": "0.00153",
      "percentile": "0.03732"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "mm/hugetlb.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "45c33966759ea1b4040c08dacda99ef623c0ca29",
                    "status": "affected",
                    "version": "1a1aad8a9b7bd34f60cdf98cd7915f00ae892c45",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0db2efb3bff879566f05341d94c3de00ac95c4cc",
                    "status": "affected",
                    "version": "1a1aad8a9b7bd34f60cdf98cd7915f00ae892c45",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dd691973f67b2800a97db723b1ff6f07fdcf7f5a",
                    "status": "affected",
                    "version": "1a1aad8a9b7bd34f60cdf98cd7915f00ae892c45",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "78504bcedb2f1bbfb353b4d233c24d641c4dda33",
                    "status": "affected",
                    "version": "1a1aad8a9b7bd34f60cdf98cd7915f00ae892c45",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "958f32ce832ba781ac20e11bb2d12a9352ea28fc",
                    "status": "affected",
                    "version": "1a1aad8a9b7bd34f60cdf98cd7915f00ae892c45",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "mm/hugetlb.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.11"
                  },
                  {
                    "lessThan": "4.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.150",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.75",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.19.*",
                    "status": "unaffected",
                    "version": "5.19.17",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.0.*",
                    "status": "unaffected",
                    "version": "6.0.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: hugetlb: fix UAF in hugetlb_handle_userfault\n\nThe vma_lock and hugetlb_fault_mutex are dropped before handling userfault\nand reacquire them again after handle_userfault(), but reacquire the\nvma_lock could lead to UAF[1,2] due to the following race,\n\nhugetlb_fault\n  hugetlb_no_page\n    /*unlock vma_lock */\n    hugetlb_handle_userfault\n      handle_userfault\n        /* unlock mm-\u003emmap_lock*/\n                                           vm_mmap_pgoff\n                                             do_mmap\n                                               mmap_region\n                                                 munmap_vma_range\n                                                   /* clean old vma */\n        /* lock vma_lock again  \u003c--- UAF */\n    /* unlock vma_lock */\n\nSince the vma_lock will unlock immediately after\nhugetlb_handle_userfault(), let\u0027s drop the unneeded lock and unlock in\nhugetlb_handle_userfault() to fix the issue.\n\n[1] https://lore.kernel.org/linux-mm/000000000000d5e00a05e834962e@google.com/\n[2] https://lore.kernel.org/linux-mm/20220921014457.1668-1-liuzixian4@huawei.com/"
          }
        ],
        "id": "CVE-2022-50630",
        "lastModified": "2026-08-04T10:18:20.150",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-08T02:15:49.223",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0db2efb3bff879566f05341d94c3de00ac95c4cc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/45c33966759ea1b4040c08dacda99ef623c0ca29"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/78504bcedb2f1bbfb353b4d233c24d641c4dda33"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/958f32ce832ba781ac20e11bb2d12a9352ea28fc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dd691973f67b2800a97db723b1ff6f07fdcf7f5a"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:37:22+00:00",
      "cve": "CVE-2022-50630",
      "id": "CVE-2022-50630",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "149",
      "product_status:known_not_affected": "125",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm: hugetlb: fix UAF in hugetlb_handle_userfault",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50630.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T01:59:55Z",
      "cve": "CVE-2022-50630",
      "id": "CVE-2022-50630",
      "initial_release_date": "2025-12-09T00:31:18Z",
      "product_status:known_affected": "354",
      "product_status:known_not_affected": "362",
      "product_status:recommended": "252",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50630",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50630.json",
      "version": "39"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.