CVE-2022-49076
published 2025-02-26CVE-2022-49076: In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Fix use-after-free bug for mm struct Under certain conditions, such as…
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.25%
17.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
RDMA/hfi1: Fix use-after-free bug for mm struct
Under certain conditions, such as MPI_Abort, the hfi1 cleanup code may
represent the last reference held on the task mm.
hfi1_mmu_rb_unregister() then drops the last reference and the mm is freed
before the final use in hfi1_release_user_pages(). A new task may
allocate the mm structure while it is still being used, resulting in
problems. One manifestation is corruption of the mmap_sem counter leading
to a hang in down_write(). Another is corruption of an mm struct that is
in use by another task.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.17.3-1 (bookworm) | linux 5.17.3-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 3d2a9d642512c21a12d19b9250e7a835dcb41a79 < 5f54364ff6cfcd14cddf5441c4a490bb28dd69f7 | 5f54364ff6cfcd14cddf5441c4a490bb28dd69f7 |
| linux | linux | >= 3d2a9d642512c21a12d19b9250e7a835dcb41a79 < 9ca11bd8222a612de0d2f54d050bfcf61ae2883f | 9ca11bd8222a612de0d2f54d050bfcf61ae2883f |
| linux | linux | >= 3d2a9d642512c21a12d19b9250e7a835dcb41a79 < 0b7186d657ee55e2cdefae498f07d5c1961e8023 | 0b7186d657ee55e2cdefae498f07d5c1961e8023 |
| linux | linux | >= 3d2a9d642512c21a12d19b9250e7a835dcb41a79 < 5a9a1b24ddb510715f8f621263938186579a965c | 5a9a1b24ddb510715f8f621263938186579a965c |
| linux | linux | >= 3d2a9d642512c21a12d19b9250e7a835dcb41a79 < 2bbac98d0930e8161b1957dc0ec99de39ade1b3c | 2bbac98d0930e8161b1957dc0ec99de39ade1b3c |
| linux | linux | >= 5.9.12 < 5.10 | 5.10 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.113-1 | 5.10.113-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 5.11 < 5.15.34 | 5.15.34 |
| linux | linux_kernel | >= 5.16 < 5.16.20 | 5.16.20 |
| linux | linux_kernel | >= 5.17 < 5.17.3 | 5.17.3 |
| linux | linux_kernel | >= 5.9.12 < 5.10.111 | 5.10.111 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: RDMA/hfi1: Fix use-after-free bug for mm struct
vendor_redhat·2025-02-26·CVSS 7.8
CVE-2022-49076 [HIGH] kernel: RDMA/hfi1: Fix use-after-free bug for mm struct
kernel: RDMA/hfi1: Fix use-after-free bug for mm struct
In the Linux kernel, the following vulnerability has been resolved:
RDMA/hfi1: Fix use-after-free bug for mm struct
Under certain conditions, such as MPI_Abort, the hfi1 cleanup code may
represent the last reference held on the task mm.
hfi1_mmu_rb_unregister() then drops the last reference and the mm is freed
before the final use in hfi1_release_user_pages(). A new task may
allocate the mm structure while it is still being used, resulting in
problems. One manifestation is corruption of the mmap_sem counter leading
to a hang in down_write(). Another is corruption of an mm struct that is
in use by another task.
This vulnerability affects the Linux kernel's RDMA (Remote Direct Memory Access) subsystem, specifically the hfi1 driver. It
Debian
CVE-2022-49076: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: ...
vendor_debian·2022·CVSS 7.8
CVE-2022-49076 [HIGH] CVE-2022-49076: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: ...
In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Fix use-after-free bug for mm struct Under certain conditions, such as MPI_Abort, the hfi1 cleanup code may represent the last reference held on the task mm. hfi1_mmu_rb_unregister() then drops the last reference and the mm is freed before the final use in hfi1_release_user_pages(). A new task may allocate the mm structure while it is still being used, resulting in problems. One manifestation is corruption of the mmap_sem counter leading to a hang in down_write(). Another is corruption of an mm struct that is in use by another task.
Scope: local
bookworm: resolved (fixed in 5.17.3-1)
bullseye: resolved (fixed in 5.10.113-1)
forky: resolved (fixed in 5.17.3-1)
sid: resolved (fixed in 5.17.3-1)
trixie: resolved (f
GHSA
GHSA-87jq-rxj7-28vf: In the Linux kernel, the following vulnerability has been resolved:
RDMA/hfi1: Fix use-after-free bug for mm struct
Under certain conditions, such a
ghsa_unreviewed·2025-02-27
CVE-2022-49076 [HIGH] CWE-416 GHSA-87jq-rxj7-28vf: In the Linux kernel, the following vulnerability has been resolved:
RDMA/hfi1: Fix use-after-free bug for mm struct
Under certain conditions, such a
In the Linux kernel, the following vulnerability has been resolved:
RDMA/hfi1: Fix use-after-free bug for mm struct
Under certain conditions, such as MPI_Abort, the hfi1 cleanup code may
represent the last reference held on the task mm.
hfi1_mmu_rb_unregister() then drops the last reference and the mm is freed
before the final use in hfi1_release_user_pages(). A new task may
allocate the mm structure while it is still being used, resulting in
problems. One manifestation is corruption of the mmap_sem counter leading
to a hang in down_write(). Another is corruption of an mm struct that is
in use by another task.
OSV
CVE-2022-49076: In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Fix use-after-free bug for mm struct Under certain conditions, such as
osv·2025-02-26·CVSS 7.8
CVE-2022-49076 [HIGH] CVE-2022-49076: In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Fix use-after-free bug for mm struct Under certain conditions, such as
In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Fix use-after-free bug for mm struct Under certain conditions, such as MPI_Abort, the hfi1 cleanup code may represent the last reference held on the task mm. hfi1_mmu_rb_unregister() then drops the last reference and the mm is freed before the final use in hfi1_release_user_pages(). A new task may allocate the mm structure while it is still being used, resulting in problems. One manifestation is corruption of the mmap_sem counter leading to a hang in down_write(). Another is corruption of an mm struct that is in use by another task.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0b7186d657ee55e2cdefae498f07d5c1961e8023https://git.kernel.org/stable/c/2bbac98d0930e8161b1957dc0ec99de39ade1b3chttps://git.kernel.org/stable/c/5a9a1b24ddb510715f8f621263938186579a965chttps://git.kernel.org/stable/c/5f54364ff6cfcd14cddf5441c4a490bb28dd69f7https://git.kernel.org/stable/c/9ca11bd8222a612de0d2f54d050bfcf61ae2883f
2025-02-26
Published