{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2022-49892",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2025-05-01T14:05:17.243Z",
        "datePublished": "2025-05-01T14:10:35.815Z",
        "dateUpdated": "2026-08-05T08:56:35.213Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T08:56:35.213Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Fix use-after-free for dynamic ftrace_ops\n\nKASAN reported a use-after-free with ftrace ops [1]. It was found from\nvmcore that perf had registered two ops with the same content\nsuccessively, both dynamic. After unregistering the second ops, a\nuse-after-free occurred.\n\nIn ftrace_shutdown(), when the second ops is unregistered, the\nFTRACE_UPDATE_CALLS command is not set because there is another enabled\nops with the same content.  Also, both ops are dynamic and the ftrace\ncallback function is ftrace_ops_list_func, so the\nFTRACE_UPDATE_TRACE_FUNC command will not be set. Eventually the value\nof 'command' will be 0 and ftrace_shutdown() will skip the rcu\nsynchronization.\n\nHowever, ftrace may be activated. When the ops is released, another CPU\nmay be accessing the ops.  Add the missing synchronization to fix this\nproblem.\n\n[1]\nBUG: KASAN: use-after-free in __ftrace_ops_list_func kernel/trace/ftrace.c:7020 [inline]\nBUG: KASAN: use-after-free in ftrace_ops_list_func+0x2b0/0x31c kernel/trace/ftrace.c:7049\nRead of size 8 at addr ffff56551965bbc8 by task syz-executor.2/14468\n\nCPU: 1 PID: 14468 Comm: syz-executor.2 Not tainted 5.10.0 #7\nHardware name: linux,dummy-virt (DT)\nCall trace:\n dump_backtrace+0x0/0x40c arch/arm64/kernel/stacktrace.c:132\n show_stack+0x30/0x40 arch/arm64/kernel/stacktrace.c:196\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x1b4/0x248 lib/dump_stack.c:118\n print_address_description.constprop.0+0x28/0x48c mm/kasan/report.c:387\n __kasan_report mm/kasan/report.c:547 [inline]\n kasan_report+0x118/0x210 mm/kasan/report.c:564\n check_memory_region_inline mm/kasan/generic.c:187 [inline]\n __asan_load8+0x98/0xc0 mm/kasan/generic.c:253\n __ftrace_ops_list_func kernel/trace/ftrace.c:7020 [inline]\n ftrace_ops_list_func+0x2b0/0x31c kernel/trace/ftrace.c:7049\n ftrace_graph_call+0x0/0x4\n __might_sleep+0x8/0x100 include/linux/perf_event.h:1170\n __might_fault mm/memory.c:5183 [inline]\n __might_fault+0x58/0x70 mm/memory.c:5171\n do_strncpy_from_user lib/strncpy_from_user.c:41 [inline]\n strncpy_from_user+0x1f4/0x4b0 lib/strncpy_from_user.c:139\n getname_flags+0xb0/0x31c fs/namei.c:149\n getname+0x2c/0x40 fs/namei.c:209\n [...]\n\nAllocated by task 14445:\n kasan_save_stack+0x24/0x50 mm/kasan/common.c:48\n kasan_set_track mm/kasan/common.c:56 [inline]\n __kasan_kmalloc mm/kasan/common.c:479 [inline]\n __kasan_kmalloc.constprop.0+0x110/0x13c mm/kasan/common.c:449\n kasan_kmalloc+0xc/0x14 mm/kasan/common.c:493\n kmem_cache_alloc_trace+0x440/0x924 mm/slub.c:2950\n kmalloc include/linux/slab.h:563 [inline]\n kzalloc include/linux/slab.h:675 [inline]\n perf_event_alloc.part.0+0xb4/0x1350 kernel/events/core.c:11230\n perf_event_alloc kernel/events/core.c:11733 [inline]\n __do_sys_perf_event_open kernel/events/core.c:11831 [inline]\n __se_sys_perf_event_open+0x550/0x15f4 kernel/events/core.c:11723\n __arm64_sys_perf_event_open+0x6c/0x80 kernel/events/core.c:11723\n [...]\n\nFreed by task 14445:\n kasan_save_stack+0x24/0x50 mm/kasan/common.c:48\n kasan_set_track+0x24/0x34 mm/kasan/common.c:56\n kasan_set_free_info+0x20/0x40 mm/kasan/generic.c:358\n __kasan_slab_free.part.0+0x11c/0x1b0 mm/kasan/common.c:437\n __kasan_slab_free mm/kasan/common.c:445 [inline]\n kasan_slab_free+0x2c/0x40 mm/kasan/common.c:446\n slab_free_hook mm/slub.c:1569 [inline]\n slab_free_freelist_hook mm/slub.c:1608 [inline]\n slab_free mm/slub.c:3179 [inline]\n kfree+0x12c/0xc10 mm/slub.c:4176\n perf_event_alloc.part.0+0xa0c/0x1350 kernel/events/core.c:11434\n perf_event_alloc kernel/events/core.c:11733 [inline]\n __do_sys_perf_event_open kernel/events/core.c:11831 [inline]\n __se_sys_perf_event_open+0x550/0x15f4 kernel/events/core.c:11723\n [...]"
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 7.8,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:L - The UAF is reached only through local paths that register/unregister dynamic ftrace_ops—primarily perf_event_open function tracing (perf_ftrace_function_register/unregister) and tracefs instances that kzalloc their own ops via ftrace_allocate_ftrace_ops—not via network or adjacent-protocol input.\nAC:L - An attacker who can create dynamic ops fully controls both sides of the race: register two ops with matching filter content, unregister/free one while ftrace remains active, and keep other CPUs in __ftrace_ops_list_func on hot call sites; no third-party state is required.\nPR:L - Worst reasonable deployments grant TRACE_MODE_WRITE (0640) via tracefs gid=tracing (Android atrace/perfetto, ChromeOS) or CAP_PERFMON for function tracing; these are delegatable low privileges, not init-namespace-only full CAP_SYS_ADMIN, matching the PR:L model used for closely related ftrace UAFs.\nUI:N - The attacker opens/closes matching perf ftrace events or creates/destroys tracing instances and generates concurrent traced work themselves; no separate victim action is required.\nS:U - The freed ftrace_ops corruption and any resulting privilege escalation remain inside the host kernel's security authority; this is not a VM escape, IOMMU bypass, or other cross-boundary compromise.\nC:H - This is a use-after-free of heap-allocated struct ftrace_ops still reachable from ftrace_ops_list walkers, so reclaim/spray of the object enables arbitrary kernel memory disclosure through field reads during list traversal.\nI:H - The same UAF covers function pointers (op->func) and related ops state consumed by __ftrace_ops_list_func, which is heap-sprayable into control-flow hijack and arbitrary write primitives.\nA:H - The confirmed KASAN/syzkaller outcome is a use-after-free read in ftrace_ops_list_func that oopses/panics the kernel and can be re-triggered by repeating the register/unregister sequence."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "kernel/trace/ftrace.c"
                    ],
                    "versions": [
                        {
                            "version": "edb096e00724f02db5f6ec7900f3bbd465c6c76f",
                            "lessThan": "ea5f2fd4640ecbb9df969bf8bb27733ae2183169",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "edb096e00724f02db5f6ec7900f3bbd465c6c76f",
                            "lessThan": "88561a66777e7a2fe06638c6dcb22a9fae0b6733",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "edb096e00724f02db5f6ec7900f3bbd465c6c76f",
                            "lessThan": "cc1b9961a0ceb70f6ca4e2f4b8bb71c87c7a495c",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "edb096e00724f02db5f6ec7900f3bbd465c6c76f",
                            "lessThan": "0e792b89e6800cd9cb4757a76a96f7ef3e8b6294",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "a60e407b961e818541ff7924afa8e51fbdb21a61",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "ed1bf4397d2219d4b9ec2d5517416ba102186650",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "100553e197e2c41eccf9fa04b2be9cd11ae21215",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "30d3c1c9c9dd31b3c3a5aa0f4f40f1e321c6c791",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "4.1.45",
                            "lessThan": "4.2",
                            "status": "affected",
                            "versionType": "semver"
                        },
                        {
                            "version": "4.4.89",
                            "lessThan": "4.5",
                            "status": "affected",
                            "versionType": "semver"
                        },
                        {
                            "version": "4.9.52",
                            "lessThan": "4.10",
                            "status": "affected",
                            "versionType": "semver"
                        },
                        {
                            "version": "4.13.4",
                            "lessThan": "4.14",
                            "status": "affected",
                            "versionType": "semver"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "kernel/trace/ftrace.c"
                    ],
                    "versions": [
                        {
                            "version": "4.14",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "4.14",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.10.154",
                            "lessThanOrEqual": "5.10.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.15.78",
                            "lessThanOrEqual": "5.15.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.0.8",
                            "lessThanOrEqual": "6.0.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.1",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.14",
                                    "versionEndExcluding": "5.10.154"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.14",
                                    "versionEndExcluding": "5.15.78"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.14",
                                    "versionEndExcluding": "6.0.8"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.14",
                                    "versionEndExcluding": "6.1"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.1.45"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.4.89"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.9.52"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "4.13.4"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/ea5f2fd4640ecbb9df969bf8bb27733ae2183169"
                },
                {
                    "url": "https://git.kernel.org/stable/c/88561a66777e7a2fe06638c6dcb22a9fae0b6733"
                },
                {
                    "url": "https://git.kernel.org/stable/c/cc1b9961a0ceb70f6ca4e2f4b8bb71c87c7a495c"
                },
                {
                    "url": "https://git.kernel.org/stable/c/0e792b89e6800cd9cb4757a76a96f7ef3e8b6294"
                }
            ],
            "title": "ftrace: Fix use-after-free for dynamic ftrace_ops",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}