CVE-2022-49554

Estado: ModificadaMedia (4.7)—

In the Linux kernel, the following vulnerability has been resolved:

zsmalloc: fix races between asynchronous zspage free and page migration

The asynchronous zspage free worker tries to lock a zspage's entire page list without defending against page migration. Since pages which haven't yet been locked can concurrently migrate off the zspage page list while lock_zspage() churns away, lock_zspage() can suffer from a few different lethal races.

It can lock a page which no longer belongs to the zspage and unsafely dereference page_private(), it can unsafely dereference a torn pointer to the next page (since there's a data race), and it can observe a spurious NULL pointer to the next page and thus not lock all of the zspage's pages (since a single page migration will reconstruct the entire page list, and create_page_chain() unconditionally zeroes out each list pointer in the process).

Leer descripción completaMostrar menos

Fix the races by using migrate_read_lock() in lock_zspage() to synchronize with page migration.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Puntuación base: 4.7

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.22%
Percentil entre todas las CVEs puntuadas: 11
Fecha de la puntuación: 4/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

CWE-362

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2022-49554",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.7,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "77ff465799c60294e248000cd22ae8171da3304c",
              "lessThan": "3674d8a8dadd03a447dd21069d4dacfc3399b63b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "77ff465799c60294e248000cd22ae8171da3304c",
              "lessThan": "645996efc2ae391246d595832aaa6f9d3cc338c7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "77ff465799c60294e248000cd22ae8171da3304c",
              "lessThan": "fc658c083904427abbf8f18280d517ee2668677c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "77ff465799c60294e248000cd22ae8171da3304c",
              "lessThan": "fae05b2314b147a78fbed1dc4c645d9a66313758",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "77ff465799c60294e248000cd22ae8171da3304c",
              "lessThan": "3ec459c8810e658401be428d3168eacfc380bdd0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "77ff465799c60294e248000cd22ae8171da3304c",
              "lessThan": "8ba7b7c1dad1f6503c541778f31b33f7f62eb966",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "77ff465799c60294e248000cd22ae8171da3304c",
              "lessThan": "c5402fb5f71f1a725f1e55d9c6799c0c7bec308f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "77ff465799c60294e248000cd22ae8171da3304c",
              "lessThan": "2505a981114dcb715f8977b8433f7540854851d8",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "mm/zsmalloc.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.14",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.14.282",
              "versionType": "semver",
              "lessThanOrEqual": "4.14.*"
            },
            {
              "status": "unaffected",
              "version": "4.19.246",
              "versionType": "semver",
              "lessThanOrEqual": "4.19.*"
            },
            {
              "status": "unaffected",
              "version": "5.4.197",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "status": "unaffected",
              "version": "5.10.120",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.45",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "5.17.13",
              "versionType": "semver",
              "lessThanOrEqual": "5.17.*"
            },
            {
              "status": "unaffected",
              "version": "5.18.2",
              "versionType": "semver",
              "lessThanOrEqual": "5.18.*"
            },
            {
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "mm/zsmalloc.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-02-26T07:01:31.223",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2505a981114dcb715f8977b8433f7540854851d8",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3674d8a8dadd03a447dd21069d4dacfc3399b63b",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3ec459c8810e658401be428d3168eacfc380bdd0",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/645996efc2ae391246d595832aaa6f9d3cc338c7",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8ba7b7c1dad1f6503c541778f31b33f7f62eb966",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c5402fb5f71f1a725f1e55d9c6799c0c7bec308f",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fae05b2314b147a78fbed1dc4c645d9a66313758",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fc658c083904427abbf8f18280d517ee2668677c",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nzsmalloc: fix races between asynchronous zspage free and page migration\n\nThe asynchronous zspage free worker tries to lock a zspage's entire page\nlist without defending against page migration.  Since pages which haven't\nyet been locked can concurrently migrate off the zspage page list while\nlock_zspage() churns away, lock_zspage() can suffer from a few different\nlethal races.\n\nIt can lock a page which no longer belongs to the zspage and unsafely\ndereference page_private(), it can unsafely dereference a torn pointer to\nthe next page (since there's a data race), and it can observe a spurious\nNULL pointer to the next page and thus not lock all of the zspage's pages\n(since a single page migration will reconstruct the entire page list, and\ncreate_page_chain() unconditionally zeroes out each list pointer in the\nprocess).\n\nFix the races by using migrate_read_lock() in lock_zspage() to synchronize\nwith page migration."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: zsmalloc: arregla las ejecuciones entre la liberación asincrónica de zspage y la migración de página El trabajador de liberación asincrónica de zspage intenta bloquear la lista completa de páginas de una zspage sin defenderse contra la migración de página. Dado que las páginas que aún no se han bloqueado pueden migrar simultáneamente fuera de la lista de páginas de la zspage mientras lock_zspage() se procesa, lock_zspage() puede sufrir algunas ejecuciones letales diferentes. Puede bloquear una página que ya no pertenece a la zspage y desreferenciar de forma insegura page_private(), puede desreferenciar de forma insegura un puntero roto a la siguiente página (ya que hay una ejecución de datos), y puede observar un puntero NULL espurio a la siguiente página y, por lo tanto, no bloquear todas las páginas de la zspage (ya que una sola migración de página reconstruirá la lista de páginas completa, y create_page_chain() pone a cero incondicionalmente cada puntero de lista en el proceso). Corrija las ejecuciones usando migrants_read_lock() en lock_zspage() para sincronizar con la migración de página."
    }
  ],
  "lastModified": "2026-08-04T10:17:51.153",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D697ED37-2BFA-4A75-9665-BBC0B0BE0FC1",
              "versionEndExcluding": "4.14.282",
              "versionStartIncluding": "4.14"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FEDF30DC-BB12-4C4C-A134-AA5D59D73C0C",
              "versionEndExcluding": "4.19.246",
              "versionStartIncluding": "4.15"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F7FDD830-741D-44F7-A537-13755A4314DE",
              "versionEndExcluding": "5.4.197",
              "versionStartIncluding": "4.20"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "92818976-ECCC-4744-9287-E2CF4B2C4131",
              "versionEndExcluding": "5.10.120",
              "versionStartIncluding": "5.5"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "08D699AD-F4CE-4BDD-A97E-4997299C7712",
              "versionEndExcluding": "5.15.45",
              "versionStartIncluding": "5.11"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "192FC54B-5367-49D6-B410-0285F14665B1",
              "versionEndExcluding": "5.17.13",
              "versionStartIncluding": "5.16"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9FF255A1-64F4-4E31-AF44-C92FB8773BA2",
              "versionEndExcluding": "5.18.2",
              "versionStartIncluding": "5.18"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}