{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-48991", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-22T01:27:53.636Z", "datePublished": "2024-10-21T20:06:08.312Z", "dateUpdated": "2026-08-05T08:53:20.576Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:53:20.576Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/khugepaged: invoke MMU notifiers in shmem/file collapse paths\n\nAny codepath that zaps page table entries must invoke MMU notifiers to\nensure that secondary MMUs (like KVM) don't keep accessing pages which\naren't mapped anymore. Secondary MMUs don't hold their own references to\npages that are mirrored over, so failing to notify them can lead to page\nuse-after-free.\n\nI'm marking this as addressing an issue introduced in commit f3f0e1d2150b\n(\"khugepaged: add support of collapse for tmpfs/shmem pages\"), but most of\nthe security impact of this only came in commit 27e1f8273113 (\"khugepaged:\nenable collapse pmd for pte-mapped THP\"), which actually omitted flushes\nfor the removal of present PTEs, not just for the removal of empty page\ntables." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is triggered by local mm paths (khugepaged or madvise/MADV_COLLAPSE) that retract host page tables mirrored into KVM; exploitation requires local or guest access to that KVM secondary MMU, not network or adjacent-link input.\nAC:L - An attacker who controls shmem/file-backed guest memory can reliably force collapse (MADV_COLLAPSE or khugepaged) and keep accessing via KVM; Jann Horn demonstrated a working KVM reproducer that reads freed page contents, with no victim-only timing or layout precondition.\nPR:L - Exploitation needs only the ability to run as an unprivileged local user with KVM access or as a KVM guest; host root or init-namespace admin capabilities are not required.\nUI:N - No separate victim action is required; the attacker (or attacker-controlled guest) drives memory setup, collapse, and secondary-MMU access themselves.\nS:C - Failing to invalidate KVM’s secondary MMU leaves the guest mapped to freed host pages after THP collapse, enabling guest-to-host memory access and crossing the guest/hypervisor security boundary.\nC:H - This is a page use-after-free through KVM; the public reproducer reads PAGE_POISON from freed file THP pages, and page reuse yields a host-kernel arbitrary-read primitive.\nI:H - Stale KVM SPTEs to freed pages also provide a write path once those pages are reused, enabling host memory corruption and control-flow hijacking consistent with UAF escape-class impact.\nA:H - Use-after-free through stale secondary-MMU mappings can oops/panic the host when freed or reused pages are accessed, and a malicious guest can repeat the trigger to deny service to the host and colocated guests." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "mm/khugepaged.c" ], "versions": [ { "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "lessThan": "275c626c131cfe141beeb6c575e31fa53d32da19", "status": "affected", "versionType": "git" }, { "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "lessThan": "c23105673228c349739e958fa33955ed8faddcaf", "status": "affected", "versionType": "git" }, { "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "lessThan": "ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3", "status": "affected", "versionType": "git" }, { "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "lessThan": "5ffc2a75534d9d74d49760f983f8eb675fa63d69", "status": "affected", "versionType": "git" }, { "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "lessThan": "7f445ca2e0e59c7971d0b7b853465e50844ab596", "status": "affected", "versionType": "git" }, { "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "lessThan": "1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3", "status": "affected", "versionType": "git" }, { "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "lessThan": "5450535901d89a5dcca5fbbc59a24fe89caeb465", "status": "affected", "versionType": "git" }, { "version": "f3f0e1d2150b2b99da2cbdfaad000089efe9bf30", "lessThan": "f268f6cf875f3220afc77bdd0bf1bb136eb54db9", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "mm/khugepaged.c" ], "versions": [ { "version": "4.8", "status": "affected" }, { "version": "0", "lessThan": "4.8", "status": "unaffected", "versionType": "semver" }, { "version": "4.9.337", "lessThanOrEqual": "4.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "4.14.303", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.270", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.227", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.159", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.83", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.0.13", "lessThanOrEqual": "6.0.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "4.9.337" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "4.14.303" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "4.19.270" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.4.227" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.10.159" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "5.15.83" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.0.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8", "versionEndExcluding": "6.1" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/275c626c131cfe141beeb6c575e31fa53d32da19" }, { "url": "https://git.kernel.org/stable/c/c23105673228c349739e958fa33955ed8faddcaf" }, { "url": "https://git.kernel.org/stable/c/ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3" }, { "url": "https://git.kernel.org/stable/c/5ffc2a75534d9d74d49760f983f8eb675fa63d69" }, { "url": "https://git.kernel.org/stable/c/7f445ca2e0e59c7971d0b7b853465e50844ab596" }, { "url": "https://git.kernel.org/stable/c/1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3" }, { "url": "https://git.kernel.org/stable/c/5450535901d89a5dcca5fbbc59a24fe89caeb465" }, { "url": "https://git.kernel.org/stable/c/f268f6cf875f3220afc77bdd0bf1bb136eb54db9" } ], "title": "mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2022-48991", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-10-22T13:16:32.481668Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T13:18:42.186Z" } } ] } }