PT-2024-11854 · Linux+5 · Linux Kernel+5
Jann Horn
·
Published
2022-11-30
·
Updated
2025-09-29
·
CVE-2022-48991
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to the version that includes the fix for the issue introduced in commit f3f0e1d2150b and exacerbated in commit 27e1f8273113
Description
The issue is related to the Linux kernel's mm/khugepaged component, where code paths that remove page table entries must invoke MMU notifiers to prevent secondary MMUs, like KVM, from accessing pages that are no longer mapped. Failing to notify these MMUs can lead to page use-after-free. The security impact of this issue was introduced in a specific commit and worsened in a subsequent commit that omitted necessary flushes for the removal of present PTEs.
Recommendations
For Linux kernel versions prior to the fixed version, consider applying the patch that invokes MMU notifiers in shmem/file collapse paths to prevent page use-after-free.
As a temporary workaround, consider restricting access to the
mm/khugepaged component until a patch is available.
Avoid using the khugepaged function with tmpfs/shmem pages until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linux Kernel
Red Hat
Red Os
Suse