CVE-2022-49753
published 2025-03-27CVE-2022-49753: In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix double increment of client_count in dma_chan_get() The first time…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.22%
12.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: Fix double increment of client_count in dma_chan_get()
The first time dma_chan_get() is called for a channel the channel
client_count is incorrectly incremented twice for public channels,
first in balance_ref_count(), and again prior to returning. This
results in an incorrect client count which will lead to the
channel resources not being freed when they should be. A simple
test of repeated module load and unload of async_tx on a Dell
Power Edge R7425 also shows this resulting in a kref underflow
warning.
[ 124.329662] async_tx: api initialized (async)
[ 129.000627] async_tx: api initialized (async)
[ 130.047839] ------------[ cut here ]------------
[ 130.052472] refcount_t: underflow; use-after-free.
[ 130.057279] WARNING: CPU: 3 PID: 19364 at lib/refcount.c:28
refcount_warn_saturate+0xba/0x110
[ 130.065811] Modules linked in: async_tx(-) rfkill intel_rapl_msr
intel_rapl_common amd64_edac edac_mce_amd ipmi_ssif kvm_amd dcdbas kvm
mgag200 drm_shmem_helper acpi_ipmi irqbypass drm_kms_helper ipmi_si
syscopyarea sysfillrect rapl pcspkr ipmi_devintf sysimgblt fb_sys_fops
k10temp i2c_piix4 ipmi_msghandler acpi_power_meter acpi_cpufreq vfat
fat drm fuse xfs libcrc32c sd_mod t10_pi sg ahci crct10dif_pclmul
libahci crc32_pclmul crc32c_intel ghash_clmulni_intel igb megaraid_sas
i40e libata i2c_algo_bit ccp sp5100_tco dca dm_mirror dm_region_hash
dm_log dm_mod [last unloaded: async_tx]
[ 130.117361] CPU: 3 PID: 19364 Comm: modprobe Kdump: loaded Not
tainted 5.14.0-185.el9.x86_64 #1
[ 130.126091] Hardware name: Dell Inc. PowerEdge R7425/02MJ3T, BIOS
1.18.0 01/17/2022
[ 130.133806] RIP: 0010:refcount_warn_saturate+0xba/0x110
[ 130.139041] Code: 01 01 e8 6d bd 55 00 0f 0b e9 72 9d 8a 00 80 3d
26 18 9c 01 00 75 85 48 c7 c7 f8 a3 03 9d c6 05 16 18 9c 01 01 e8 4a
bd 55 00 0b e9 4f 9d 8a 00 80 3d 01 18 9c 01 00 0f 85 5e ff ff ff
48 c7
[ 130.157807] RSP: 0018:ffffbf98898afe68 EFLAGS: 00010286
[ 130.1630
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.11-1 (bookworm) | linux 6.1.11-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= d2f4f99db3e9ec8b063cf2e45704e2bb95428317 < 1b409e14b4b7af034e0450f95c165b6c5c87dbc1 | 1b409e14b4b7af034e0450f95c165b6c5c87dbc1 |
| linux | linux | >= d2f4f99db3e9ec8b063cf2e45704e2bb95428317 < c6221afe573413fd2981e291f7df4a58283e0654 | c6221afe573413fd2981e291f7df4a58283e0654 |
| linux | linux | >= d2f4f99db3e9ec8b063cf2e45704e2bb95428317 < 18dd3b30d4c7e8440c63118c7a7b687372b9567f | 18dd3b30d4c7e8440c63118c7a7b687372b9567f |
| linux | linux | >= d2f4f99db3e9ec8b063cf2e45704e2bb95428317 < 42ecd72f02cd657b00b559621e7ef7d2c4d3e5f1 | 42ecd72f02cd657b00b559621e7ef7d2c4d3e5f1 |
| linux | linux | >= d2f4f99db3e9ec8b063cf2e45704e2bb95428317 < 71c601965532c38030133535f7cd93c1efa75af1 | 71c601965532c38030133535f7cd93c1efa75af1 |
| linux | linux | >= d2f4f99db3e9ec8b063cf2e45704e2bb95428317 < 142d644fd2cc059ffa042fbfb68e766433ef3afd | 142d644fd2cc059ffa042fbfb68e766433ef3afd |
| linux | linux | >= d2f4f99db3e9ec8b063cf2e45704e2bb95428317 < f3dc1b3b4750851a94212dba249703dd0e50bb20 | f3dc1b3b4750851a94212dba249703dd0e50bb20 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.11-1 | 6.1.11-1 |
| linux | linux_kernel | >= 0 < 6.1.11-1 | 6.1.11-1 |
| linux | linux_kernel | >= 0 < 6.1.11-1 | 6.1.11-1 |
| linux | linux_kernel | >= 4.0 < 4.14.305 | 4.14.305 |
| linux | linux_kernel | >= 4.15 < 4.19.272 | 4.19.272 |
| linux | linux_kernel | >= 4.20 < 5.4.231 | 5.4.231 |
| linux | linux_kernel | >= 5.11 < 5.15.91 | 5.15.91 |
| linux | linux_kernel | >= 5.16 < 6.1.9 | 6.1.9 |
| linux | linux_kernel | >= 5.5 < 5.10.166 | 5.10.166 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2022-49753: In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix double increment of client_count in dma_chan_get() The first time d
osv·2025-03-27·CVSS 7.8
CVE-2022-49753 [HIGH] CVE-2022-49753: In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix double increment of client_count in dma_chan_get() The first time d
In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix double increment of client_count in dma_chan_get() The first time dma_chan_get() is called for a channel the channel client_count is incorrectly incremented twice for public channels, first in balance_ref_count(), and again prior to returning. This results in an incorrect client count which will lead to the channel resources not being freed when they should be. A simple test of repeated module load and unload of async_tx on a Dell Power Edge R7425 also shows this resulting in a kref underflow warning. [ 124.329662] async_tx: api initialized (async) [ 129.000627] async_tx: api initialized (async) [ 130.047839] ------------[ cut here ]------------ [ 130.052472] refcount_t: underflow; use-after-free. [ 130.0572
GHSA
GHSA-c6c6-6xm6-jhp9: In the Linux kernel, the following vulnerability has been resolved:
dmaengine: Fix double increment of client_count in dma_chan_get()
The first time
ghsa_unreviewed·2025-03-27
CVE-2022-49753 [HIGH] CWE-416 GHSA-c6c6-6xm6-jhp9: In the Linux kernel, the following vulnerability has been resolved:
dmaengine: Fix double increment of client_count in dma_chan_get()
The first time
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: Fix double increment of client_count in dma_chan_get()
The first time dma_chan_get() is called for a channel the channel
client_count is incorrectly incremented twice for public channels,
first in balance_ref_count(), and again prior to returning. This
results in an incorrect client count which will lead to the
channel resources not being freed when they should be. A simple
test of repeated module load and unload of async_tx on a Dell
Power Edge R7425 also shows this resulting in a kref underflow
warning.
[ 124.329662] async_tx: api initialized (async)
[ 129.000627] async_tx: api initialized (async)
[ 130.047839] ------------[ cut here ]------------
[ 130.052472] refcount_t: underflow; use-after-free.
[ 130.0
Red Hat
kernel: dmaengine: Fix double increment of client_count in dma_chan_get()
vendor_redhat·2025-03-27·CVSS 7.8
CVE-2022-49753 [HIGH] kernel: dmaengine: Fix double increment of client_count in dma_chan_get()
kernel: dmaengine: Fix double increment of client_count in dma_chan_get()
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: Fix double increment of client_count in dma_chan_get()
The first time dma_chan_get() is called for a channel the channel
client_count is incorrectly incremented twice for public channels,
first in balance_ref_count(), and again prior to returning. This
results in an incorrect client count which will lead to the
channel resources not being freed when they should be. A simple
test of repeated module load and unload of async_tx on a Dell
Power Edge R7425 also shows this resulting in a kref underflow
warning.
[ 124.329662] async_tx: api initialized (async)
[ 129.000627] async_tx: api initialized (async)
[ 130.047839] ------------[ cut here ]-
Debian
CVE-2022-49753: linux - In the Linux kernel, the following vulnerability has been resolved: dmaengine: ...
vendor_debian·2022·CVSS 7.8
CVE-2022-49753 [HIGH] CVE-2022-49753: linux - In the Linux kernel, the following vulnerability has been resolved: dmaengine: ...
In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix double increment of client_count in dma_chan_get() The first time dma_chan_get() is called for a channel the channel client_count is incorrectly incremented twice for public channels, first in balance_ref_count(), and again prior to returning. This results in an incorrect client count which will lead to the channel resources not being freed when they should be. A simple test of repeated module load and unload of async_tx on a Dell Power Edge R7425 also shows this resulting in a kref underflow warning. [ 124.329662] async_tx: api initialized (async) [ 129.000627] async_tx: api initialized (async) [ 130.047839] ------------[ cut here ]------------ [ 130.052472] refcount_t: underflow; use-after-free. [ 130.0572
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/142d644fd2cc059ffa042fbfb68e766433ef3afdhttps://git.kernel.org/stable/c/18dd3b30d4c7e8440c63118c7a7b687372b9567fhttps://git.kernel.org/stable/c/1b409e14b4b7af034e0450f95c165b6c5c87dbc1https://git.kernel.org/stable/c/42ecd72f02cd657b00b559621e7ef7d2c4d3e5f1https://git.kernel.org/stable/c/71c601965532c38030133535f7cd93c1efa75af1https://git.kernel.org/stable/c/c6221afe573413fd2981e291f7df4a58283e0654https://git.kernel.org/stable/c/f3dc1b3b4750851a94212dba249703dd0e50bb20
2025-03-27
Published