PT-2025-8599 · Linux+3 · Linux Kernel+3

Published 2022-01-01 · Updated 2026-03-14 · CVE-2022-49666

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the version containing commit ffa0b64e3be5

Description A bug in the Linux kernel has been resolved, related to memory hotplug. The issue arises when the kernel validates an address against the high memory value, resulting in a BUG ON with dax pfns. This occurs due to a commit that fixed virt addr valid() for 64-bit Book3E & 32-bit, causing the kernel to validate the address against high memory. The estimated number of potentially affected devices is not specified.

Recommendations To resolve the issue, update the Linux kernel to a version that includes the fix, which ensures high memory is updated on memory hotplug, similar to the fix introduced in commit 3072e413e305 for x86. As a temporary workaround, consider disabling memory hotplug until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2022-49666

RHSA-2023:2458

RHSA-2023_2458

Affected Products

Astra Linux

Debian

Linux Kernel

Red Hat

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49666.json · Exploit
• https://ubuntu.com/security/CVE-2022-49666 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2022-49666 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49666 · Security Note
• https://osv.dev/vulnerability/CVE-2022-49666 · Vendor Advisory
• https://git.kernel.org/stable/c/89296ac435e2cf8a5101f7fab8f0c7b754b92052 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49666 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49666 · Vendor Advisory
• https://git.kernel.org/stable/c/ac790d09885d36143076e7e02825c541e8eee899 · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-49666 · Vendor Advisory
• https://git.kernel.org/stable/c/84d146fd35a01b08e9515041de60f0f915a417d5 · Patch
• https://cve.org/CVERecord?id=CVE-2022-49666 · Security Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://lore.kernel.org/linux-cve-announce/2025022623-CVE-2022-49666-98ab@gregkh/T · Note
• https://git.kernel.org/linus/ac790d09885d36143076e7e02825c541e8eee899 · Note