PT-2025-8189 · Linux+2 · Linux Kernel+2

Jackson Cody · Published 2022-03-14 · Updated 2025-04-15 · CVE-2022-49261

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.17.0-rc6-ci-drm-11296+ #1

Description A missing bounds check in the vm access() function can lead to an out-of-bounds read or write in the adjacent memory area. This issue is related to the len attribute not being validated before the memcpy later in the function. The problem can potentially cause a page fault, as indicated by the error message BUG: unable to handle page fault for address. The vm access() function is part of the drm/i915/gem module.

Recommendations For Linux kernel version 5.17.0-rc6-ci-drm-11296+ #1, update to a version that includes the fix for the missing boundary check in vm access(). As a temporary workaround, consider restricting access to the vm access() function until a patch is available.

Exploit

Fix

Out of bounds Read

Memory Corruption

Weakness Enumeration

CWE-125

CWE-787

Related Identifiers

BDU:2026-03936

CVE-2022-49261

OPENSUSE-SU-2025_1263-1

SUSE-SU-2025:1027-1

SUSE-SU-2025:1176-1

SUSE-SU-2025:1183-1

SUSE-SU-2025:1194-1

SUSE-SU-2025:1241-1

SUSE-SU-2025:1263-1

SUSE-SU-2025_1027-1

SUSE-SU-2025_1241-1

SUSE-SU-2025_1263-1

Affected Products

Astra Linux

Linux Kernel

Suse

References · 1348

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49261.json · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2025:1263-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49261 · Security Note
• https://git.kernel.org/stable/c/5f6e560e3e86ac053447524224e411034f41f5c7 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1027-1 · Vendor Advisory
• https://git.kernel.org/stable/c/8f0ebea8f6e8c474264ed97d7a64c9c09ed4f5aa · Patch
• https://osv.dev/vulnerability/CVE-2022-49261 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49261 · Vendor Advisory
• https://git.kernel.org/stable/c/89ddcc81914ab58cc203acc844f27d55ada8ec0e · Patch
• https://git.kernel.org/stable/c/312d3d4f49e12f97260bcf972c848c3562126a18 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1241-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49261 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49261 · Security Note
• https://git.kernel.org/stable/c/3886a86e7e6cc6ce2ce93c440fecd8f42aed0ce7 · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-49261 · Vendor Advisory