CVE-2022-48802: In the Linux kernel, the following vulnerability has been resolved: fs/proc: task_mmu.c: don't read mapcount for migration entry The syzbot reported the below…

PriorityP420medium5.5CVSS 3.1

AVLACLPRLUINSUCNINAH

EPSS

0.29%

21.2th percentile

In the Linux kernel, the following vulnerability has been resolved: fs/proc: task_mmu.c: don't read mapcount for migration entry The syzbot reported the below BUG: kernel BUG at include/linux/page-flags.h:785! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 4392 Comm: syz-executor560 Not tainted 5.16.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:PageDoubleMap include/linux/page-flags.h:785 [inline] RIP: 0010:__page_mapcount+0x2d2/0x350 mm/util.c:744 Call Trace: page_mapcount include/linux/mm.h:837 [inline] smaps_account+0x470/0xb10 fs/proc/task_mmu.c:466 smaps_pte_entry fs/proc/task_mmu.c:538 [inline] smaps_pte_range+0x611/0x1250 fs/proc/task_mmu.c:601 walk_pmd_range mm/pagewalk.c:128 [inline] walk_pud_range mm/pagewalk.c:205 [inline] walk_p4d_range mm/pagewalk.c:240 [inline] walk_pgd_range mm/pagewalk.c:277 [inline] __walk_page_range+0xe23/0x1ea0 mm/pagewalk.c:379 walk_page_vma+0x277/0x350 mm/pagewalk.c:530 smap_gather_stats.part.0+0x148/0x260 fs/proc/task_mmu.c:768 smap_gather_stats fs/proc/task_mmu.c:741 [inline] show_smap+0xc6/0x440 fs/proc/task_mmu.c:822 seq_read_iter+0xbb0/0x1240 fs/seq_file.c:272 seq_read+0x3e0/0x5b0 fs/seq_file.c:162 vfs_read+0x1b5/0x600 fs/read_write.c:479 ksys_read+0x12d/0x250 fs/read_write.c:619 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae The reproducer was trying to read /proc/$PID/smaps when calling MADV_FREE at the mean time. MADV_FREE may split THPs if it is called for partial THP. It may trigger the below race: CPU A CPU B ----- ----- smaps walk: MADV_FREE: page_mapcount() PageCompound() split_huge_page() page = compound_head(page) PageDoubleMap(page) When calling PageDoubleMap() this page is not a tail page of THP anymore so the BUG is triggered. This could be fixed by elevated refcount of the page before calling mapcount, but that would prevent it

Affected

14 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.16.10-1 (bookworm)	linux 5.16.10-1 (bookworm)
linux	linux	—	—
linux	linux	>= e9b61f19858a5d6c42ce2298cf138279375d0d9b < db3f3636e4aed2cba3e4e7897a053323f7a62249	db3f3636e4aed2cba3e4e7897a053323f7a62249
linux	linux	>= e9b61f19858a5d6c42ce2298cf138279375d0d9b < a8dd0cfa37792863b6c4bf9542975212a6715d49	a8dd0cfa37792863b6c4bf9542975212a6715d49
linux	linux	>= e9b61f19858a5d6c42ce2298cf138279375d0d9b < 05d3f8045efa59457b323caf00bdb9273b7962fa	05d3f8045efa59457b323caf00bdb9273b7962fa
linux	linux	>= e9b61f19858a5d6c42ce2298cf138279375d0d9b < 24d7275ce2791829953ed4e72f68277ceb2571c6	24d7275ce2791829953ed4e72f68277ceb2571c6
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 5.10.103-1	5.10.103-1
linux	linux_kernel	>= 0 < 5.16.10-1	5.16.10-1
linux	linux_kernel	>= 0 < 5.16.10-1	5.16.10-1
linux	linux_kernel	>= 0 < 5.16.10-1	5.16.10-1
linux	linux_kernel	>= 4.5 < 5.10.102	5.10.102
linux	linux_kernel	>= 5.11 < 5.15.25	5.15.25
linux	linux_kernel	>= 5.16 < 5.16.10	5.16.10

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv5.5MEDIUM

vendor_debian5.5MEDIUM

vendor_redhat5.5MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.