TI-2022-24505 Aliases CVE-2022-48986 GHSA-jvvc-hqpp-3w3v

mm/gup: fix gup_pud_range() for dax

LOW 34Published 2024-10-21 · Updated 2026-08-05

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix gup_pud_range() for dax For dax pud, pud_huge() returns true on x86. So the function works as long as hugetlb is configured. However, dax doesn't depend on hugetlb. Commit 414fd080d125 ("mm/gup: fix gup_pmd_range() for dax") fixed devmap-backed huge PMDs, but missed devmap-backed huge PUDs. Fix this as well. This fixes the below kernel panic: general protection fault, probably for non-canonical address 0x69e7c000cc478: 0000 [#1] SMP < snip > Call Trace: <TASK> get_user_pages_fast+0x1f/0x40 iov_iter_get_pages+0xc6/0x3b0 ? mempool_alloc+0x5d/0x170 bio_iov_iter_get_pages+0x82/0x4e0 ? bvec_alloc+0x91/0xc0 ? bio_alloc_bioset+0x19a/0x2a0 blkdev_direct_IO+0x282/0x480 ? __io_complete_rw_common+0xc0/0xc0 ? filemap_range_has_page+0x82/0xc0 generic_file_direct_write+0x9d/0x1a0 ? inode_update_time+0x24/0x30 __generic_file_write_iter+0xbd/0x1e0 blkdev_write_iter+0xb4/0x150 ? io_import_iovec+0x8d/0x340 io_write+0xf9/0x300 io_issue_sqe+0x3c3/0x1d30 ? sysvec_reschedule_ipi+0x6c/0x80 __io_queue_sqe+0x33/0x240 ? fget+0x76/0xa0 io_submit_sqes+0xe6a/0x18d0 ? __fget_light+0xd1/0x100 __x64_sys_io_uring_enter+0x199/0x880 ? __context_tracking_enter+0x1f/0x70 ? irqentry_exit_to_user_mode+0x24/0x30 ? irqentry_exit+0x1d/0x30 ? __context_tracking_exit+0xe/0x70 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fc97c11a7be < snip > </TASK> ---[ end trace 48b2e0e67debcaeb ]--- RIP: 0010:internal_get_user_pages_fast+0x340/0x990 < snip > Kernel panic - not syncing: Fatal exception Kernel Offset: disabled

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00255 17th percentileScored 2026-11-07

Fix Partial Linux (Linux): 4.10, 4.15, 4.20 +5Red Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Linux	Linux	4.9.165 to before 4.10; 4.14.108 to before 4.15; 4.19.31 to before 4.20	4.10, 4.15, 4.20	Patch available	CNA
Linux	Linux	5.0 and later	5.4.227, 5.10.159, 5.15.83, 6.0.13, 6.1	Patch available	CNA

Linux VendorLinux Affected 4.9.165 to before 4.10; 4.14.108 to before 4.15; 4.19.31 to before 4.20 Fixed in 4.10, 4.15, 4.20 Patch available CNA
Linux VendorLinux Affected 5.0 and later Fixed in 5.4.227, 5.10.159, 5.15.83, 6.0.13, 6.1 Patch available CNA

CPE configurations NVD · 9

CPE	Versions	Role	Vendor
cpe:2.3:o:linux:linux_kernel::::::::	4.9.165 to before 4.10; 4.14.108 to before 4.15; 4.19.31 to before 4.20; 5.0 to before 5.4.227; 5.5 to before 5.10.159; 5.11 to before 5.15.83; 5.16 to before 6.0.13	Vulnerable	Linux
cpe:2.3:o:linux:linux_kernel:6.1:rc1::::::	6.1 rc1	Vulnerable	Linux
cpe:2.3:o:linux:linux_kernel:6.1:rc2::::::	6.1 rc2	Vulnerable	Linux
cpe:2.3:o:linux:linux_kernel:6.1:rc3::::::	6.1 rc3	Vulnerable	Linux
cpe:2.3:o:linux:linux_kernel:6.1:rc4::::::	6.1 rc4	Vulnerable	Linux
cpe:2.3:o:linux:linux_kernel:6.1:rc5::::::	6.1 rc5	Vulnerable	Linux
cpe:2.3:o:linux:linux_kernel:6.1:rc6::::::	6.1 rc6	Vulnerable	Linux
cpe:2.3:o:linux:linux_kernel:6.1:rc7::::::	6.1 rc7	Vulnerable	Linux
cpe:2.3:o:linux:linux_kernel:6.1:rc8::::::	6.1 rc8	Vulnerable	Linux

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 4.9.165 to before 4.10; 4.14.108 to before 4.15; 4.19.31 to before 4.20; 5.0 to before 5.4.227; 5.5 to before 5.10.159; 5.11 to before 5.15.83; 5.16 to before 6.0.13 Vulnerable ·Linux
cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:* Versions 6.1 rc1 Vulnerable ·Linux
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:* Versions 6.1 rc2 Vulnerable ·Linux
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:* Versions 6.1 rc3 Vulnerable ·Linux
cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:* Versions 6.1 rc4 Vulnerable ·Linux
cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:* Versions 6.1 rc5 Vulnerable ·Linux
cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:* Versions 6.1 rc6 Vulnerable ·Linux
cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:* Versions 6.1 rc7 Vulnerable ·Linux
cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:* Versions 6.1 rc8 Vulnerable ·Linux

Remediation

Fix · CNA Linux (Linux) Fixed in 4.10, 4.15, 4.20
Fix · CNA Linux (Linux) Fixed in 5.4.227, 5.10.159, 5.15.83, 6.0.13, 6.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 8	Affected	No fix yet
Red Hat Enterprise Linux 9	Affected	No fix yet

Not affected: 3 products

Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9

Timeline

2026-10-02 Threatist record created from CVE-2022-48986
2026-10-03 Alias added: GHSA-jvvc-hqpp-3w3v

References

Patch 5

TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3

See all 15278 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences