01 Record

CVE-2022-48991

mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths

HighPUBLISHEDCNA: Linux

CNA base score8.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

View raw JSON

02 Description

mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.25% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 16.4% of scored records. A rank, not a probability.

NVD base score

7.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-08-04.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2024-10-21 20:06Z2 YR AGO

Last updated

2026-08-05 08:53Z2 MO AGO

Reserved

2024-08-22

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 8.8)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-416Use After FreeVariant

Data version

5.2

Document digest

c032721d4b9481e2cc9fc0a98c28f66f05f5f1a0459c466e9525a0ee20eab1bb

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxf3f0e1d2150b2b99da2cbdfaad000089efe9bf30 to < 275c626c131cfe141beeb6c575e31fa53d32da19, f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 to < c23105673228c349739e958fa33955ed8faddcaf, f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 to < ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3, f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 to < 5ffc2a75534d9d74d49760f983f8eb675fa63d69, f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 to < 7f445ca2e0e59c7971d0b7b853465e50844ab596, f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 to < 1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3, f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 to < 5450535901d89a5dcca5fbbc59a24fe89caeb465, f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 to < f268f6cf875f3220afc77bdd0bf1bb136eb54db9, 4.8—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/275c626c131cfe141beeb6c575e31fa53d32da19
git.kernel.orghttps://git.kernel.org/stable/c/c23105673228c349739e958fa33955ed8faddcaf
git.kernel.orghttps://git.kernel.org/stable/c/ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3
git.kernel.orghttps://git.kernel.org/stable/c/5ffc2a75534d9d74d49760f983f8eb675fa63d69
git.kernel.orghttps://git.kernel.org/stable/c/7f445ca2e0e59c7971d0b7b853465e50844ab596
git.kernel.orghttps://git.kernel.org/stable/c/1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3
git.kernel.orghttps://git.kernel.org/stable/c/5450535901d89a5dcca5fbbc59a24fe89caeb465
git.kernel.orghttps://git.kernel.org/stable/c/f268f6cf875f3220afc77bdd0bf1bb136eb54db9

07 Fixed in

Debian 12

linux
Fixed in 6.1.4-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.1.4-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 6.1.4-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.