CVE-2022-49511 (GCVE-0-2022-49511)
Vulnerability from cvelistv5
Published
2025-02-26 02:13
Modified
2026-08-05 08:55
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: fbdev: defio: fix the pagelist corruption Easily hit the below list corruption: == list_add corruption. prev->next should be next (ffffffffc0ceb090), but was ffffec604507edc8. (prev=ffffec604507edc8). WARNING: CPU: 65 PID: 3959 at lib/list_debug.c:26 __list_add_valid+0x53/0x80 CPU: 65 PID: 3959 Comm: fbdev Tainted: G U RIP: 0010:__list_add_valid+0x53/0x80 Call Trace: <TASK> fb_deferred_io_mkwrite+0xea/0x150 do_page_mkwrite+0x57/0xc0 do_wp_page+0x278/0x2f0 __handle_mm_fault+0xdc2/0x1590 handle_mm_fault+0xdd/0x2c0 do_user_addr_fault+0x1d3/0x650 exc_page_fault+0x77/0x180 ? asm_exc_page_fault+0x8/0x30 asm_exc_page_fault+0x1e/0x30 RIP: 0033:0x7fd98fc8fad1 == Figure out the race happens when one process is adding &page->lru into the pagelist tail in fb_deferred_io_mkwrite(), another process is re-initializing the same &page->lru in fb_deferred_io_fault(), which is not protected by the lock. This fix is to init all the page lists one time during initialization, it not only fixes the list corruption, but also avoids INIT_LIST_HEAD() redundantly. V2: change "int i" to "unsigned int i" (Geert Uytterhoeven)
References
Impacted products
Vendor Product Version
Linux Linux Version: 5d3aff76a3165087b0f897c0d677dfa987d9875d
Version: 105a940416fc622406653b6fe54732897642dfbc
Version: 105a940416fc622406653b6fe54732897642dfbc
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/core/fb_defio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e79b2b2aadeffe1db54a6b569b9b621575c3eb07",
              "status": "affected",
              "version": "5d3aff76a3165087b0f897c0d677dfa987d9875d",
              "versionType": "git"
            },
            {
              "lessThan": "6a9ae2fe887042f76fd3d334349e64e8ab3c55a2",
              "status": "affected",
              "version": "105a940416fc622406653b6fe54732897642dfbc",
              "versionType": "git"
            },
            {
              "lessThan": "856082f021a28221db2c32bd0531614a8382be67",
              "status": "affected",
              "version": "105a940416fc622406653b6fe54732897642dfbc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/core/fb_defio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.3",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: defio: fix the pagelist corruption\n\nEasily hit the below list corruption:\n==\nlist_add corruption. prev-\u003enext should be next (ffffffffc0ceb090), but\nwas ffffec604507edc8. (prev=ffffec604507edc8).\nWARNING: CPU: 65 PID: 3959 at lib/list_debug.c:26\n__list_add_valid+0x53/0x80\nCPU: 65 PID: 3959 Comm: fbdev Tainted: G     U\nRIP: 0010:__list_add_valid+0x53/0x80\nCall Trace:\n \u003cTASK\u003e\n fb_deferred_io_mkwrite+0xea/0x150\n do_page_mkwrite+0x57/0xc0\n do_wp_page+0x278/0x2f0\n __handle_mm_fault+0xdc2/0x1590\n handle_mm_fault+0xdd/0x2c0\n do_user_addr_fault+0x1d3/0x650\n exc_page_fault+0x77/0x180\n ? asm_exc_page_fault+0x8/0x30\n asm_exc_page_fault+0x1e/0x30\nRIP: 0033:0x7fd98fc8fad1\n==\n\nFigure out the race happens when one process is adding \u0026page-\u003elru into\nthe pagelist tail in fb_deferred_io_mkwrite(), another process is\nre-initializing the same \u0026page-\u003elru in fb_deferred_io_fault(), which is\nnot protected by the lock.\n\nThis fix is to init all the page lists one time during initialization,\nit not only fixes the list corruption, but also avoids INIT_LIST_HEAD()\nredundantly.\n\nV2: change \"int i\" to \"unsigned int i\" (Geert Uytterhoeven)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached by opening and mmap\u0027ing a framebuffer device (/dev/fb*), then triggering page faults and page_mkwrite through local memory writes; it is not reachable via network packets or protocols.\nAC:L - The race is between fb_deferred_io_fault() (unlocked INIT_LIST_HEAD on page-\u003elru) and fb_deferred_io_mkwrite() (list_add under lock); the attacker controls both sides via concurrent mappings/processes and the commit notes it is easily hit.\nPR:L - fb_open() has no capability check; access is only gated by /dev/fb* permissions (typically root:video 0660), which unprivileged local users in the video group or with session uaccess can obtain.\nUI:N - The attacker triggers the race themselves by mmap\u0027ing and writing the framebuffer; no separate victim action is required.\nS:U - Corruption occurs in the local kernel\u0027s deferred-I/O pagelist and can escalate privileges within the same OS security authority, not across VM/host or IOMMU boundaries.\nC:H - INIT_LIST_HEAD on an enlisted page-\u003elru corrupts kernel list pointers, a classic memory-corruption primitive that can be leveraged for arbitrary kernel reads.\nI:H - The same list corruption enables use-after-free and write primitives when subsequent list_add/list_del/workqueue walks continue on the corrupted pagelist, allowing control-flow hijacking.\nA:H - The observed failure is kernel list_add corruption leading to WARN/oops, and corrupted list walks can panic or hang the kernel even without full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:55:24.670Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e79b2b2aadeffe1db54a6b569b9b621575c3eb07"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a9ae2fe887042f76fd3d334349e64e8ab3c55a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/856082f021a28221db2c32bd0531614a8382be67"
        }
      ],
      "title": "fbdev: defio: fix the pagelist corruption",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49511",
    "datePublished": "2025-02-26T02:13:41.433Z",
    "dateReserved": "2025-02-26T02:08:31.587Z",
    "dateUpdated": "2026-08-05T08:55:24.670Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.