PT-2025-25889 · Linux+2 · Linux Kernel+2

Published 2022-08-23 · Updated 2025-07-15 · CVE-2022-49963

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the handling of CCS in the Linux kernel, specifically in the drm/i915/ttm component. It appears that the migrate copy() function has problems with large objects, including integer overflows and improper page copying for objects larger than 8M. This can lead to a GEM BUG ON error when the number of CCS blocks exceeds the allowed limit. The issue can be triggered with certain tests, such as gem lmem swapping, when using larger object sizes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Integer Overflow

Weakness Enumeration

CWE-787

CWE-190

Related Identifiers

BDU:2026-04898

CVE-2022-49963

SUSE-SU-2025:02264-1

SUSE-SU-2025:02321-1

SUSE-SU-2025:2264-1

SUSE-SU-2025_02264-1

Affected Products

Astra Linux

Linux Kernel

Suse

References · 577

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49963.json · Exploit
• https://git.kernel.org/stable/c/97434cb55bd884bd268626ec41489f79b261b2d4 · Patch
• https://bdu.fstec.ru/vul/2026-04898 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-49963 · Security Note
• https://git.kernel.org/stable/c/8d905254162965c8e6be697d82c7dbf5d08f574d · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49963 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49963 · Security Note
• https://osv.dev/vulnerability/CVE-2022-49963 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02321-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-49963 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-49963 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49963 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02264-1 · Vendor Advisory
• https://bugzilla.suse.com/1244825 · Note
• https://bugzilla.suse.com/1245064 · Note