CVE-2022-49989

published 2025-06-18

CVE-2022-49989: In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix error exit of privcmd_ioctl_dm_op() The error exit of…

Priority P4 19 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

xen/privcmd: fix error exit of privcmd_ioctl_dm_op()

The error exit of privcmd_ioctl_dm_op() is calling unlock_pages()
potentially with pages being NULL, leading to a NULL dereference.

Additionally lock_pages() doesn't check for pin_user_pages_fast()
having been completely successful, resulting in potentially not
locking all pages into memory. This could result in sporadic failures
when using the related memory in user mode.

Fix all of that by calling unlock_pages() always with the real number
of pinned pages, which will be zero in case pages being NULL, and by
checking the number of pages pinned by pin_user_pages_fast() matching
the expected number of pages.

Affected

14 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.0.2-1 (bookworm)	linux 6.0.2-1 (bookworm)
linux	linux	—	—
linux	linux	>= ab520be8cd5d56867fc95cfbc34b90880faf1f9d < 6de50db104af0dc921f593fd95c55db86a52ceef	6de50db104af0dc921f593fd95c55db86a52ceef
linux	linux	>= ab520be8cd5d56867fc95cfbc34b90880faf1f9d < c2b7bae7c90051fd6a679d5dee00400d67ebbf4a	c2b7bae7c90051fd6a679d5dee00400d67ebbf4a
linux	linux	>= ab520be8cd5d56867fc95cfbc34b90880faf1f9d < 45d47bd9b96e7874b98dbcc7602fe2826c5d62a6	45d47bd9b96e7874b98dbcc7602fe2826c5d62a6
linux	linux	>= ab520be8cd5d56867fc95cfbc34b90880faf1f9d < c5deb27895e017a0267de0a20d140ad5fcc55a54	c5deb27895e017a0267de0a20d140ad5fcc55a54
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 5.10.140-1	5.10.140-1
linux	linux_kernel	>= 0 < 6.0.2-1	6.0.2-1
linux	linux_kernel	>= 0 < 6.0.2-1	6.0.2-1
linux	linux_kernel	>= 0 < 6.0.2-1	6.0.2-1
linux	linux_kernel	>= 4.11 < 5.10.140	5.10.140
linux	linux_kernel	>= 5.11 < 5.15.64	5.15.64
linux	linux_kernel	>= 5.16 < 5.19.6	5.19.6

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-476