PT-2025-25914 · Linux · Linux Kernel

Published 2025-06-18 · Updated 2025-06-18 · CVE-2022-49988

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been resolved, related to the binder alloc module. The issue involved missing mmap lock calls when using the VMA. Specifically, the mmap read lock() was not taken when using the VMA in binder alloc print pages() and when checking for a VMA in binder alloc new buf locked(). It is noted that binder alloc new buf locked() drops the VMA read lock after verifying a VMA exists, but it may be taken again deeper in the call stack if necessary.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2022-49988

Affected Products

Linux Kernel

References · 9

• https://security-tracker.debian.org/tracker/CVE-2022-49988 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49988 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-49988 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49988 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-49988 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-49988 · Vendor Advisory
• https://git.kernel.org/stable/c/44e602b4e52f70f04620bbbf4fe46ecb40170bde · Note
• https://git.kernel.org/stable/c/7b0163c1b07b7ff1717aa975821c40df98786ddc · Note
• https://git.kernel.org/stable/c/577d9c05cc48c5242bcf719c06a5baf3105473ad · Note