GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49359 (GCVE-0-2022-49359)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:11 – Updated: 2026-08-05 08:54
VLAI
Title
drm/panfrost: Job should reference MMU not file_priv
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/panfrost: Job should reference MMU not file_priv For a while now it's been allowed for a MMU context to outlive it's corresponding panfrost_priv, however the job structure still references panfrost_priv to get hold of the MMU context. If panfrost_priv has been freed this is a use-after-free which I've been able to trigger resulting in a splat. To fix this, drop the reference to panfrost_priv in the job structure and add a direct reference to the MMU structure which is what's actually needed.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-27 18:16 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7fdc48cc63a30fa3480d18bdd8c5fff2b9b15212 , < 8c8e8cc91a6ffc79865108279a74fd57d9070a17 (git)
Affected: 7fdc48cc63a30fa3480d18bdd8c5fff2b9b15212 , < 472dd7ea5e19a1aeabf1711ddc756777e05ee7c2 (git)
Affected: 7fdc48cc63a30fa3480d18bdd8c5fff2b9b15212 , < 6e516faf04317db2c46cbec4e3b78b4653a5b109 (git)
Affected: c29485e34e63198dca6289639aa711f99d88e76e (git)
Affected: 626adede2642f00c8918999a2451bd0a644ab9b7 (git)
Affected: cf461fa9250a634e8afc4433d82ae0decea8136e (git)
Affected: 5.10.67 , < 5.11 (semver)
Affected: 5.13.19 , < 5.14 (semver)
Affected: 5.14.6 , < 5.15 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.17.15 , ≤ 5.17.* (semver)
Unaffected: 5.18.4 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49359",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T18:16:38.134749Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:22:33.808Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panfrost/panfrost_drv.c",
            "drivers/gpu/drm/panfrost/panfrost_job.c",
            "drivers/gpu/drm/panfrost/panfrost_job.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8c8e8cc91a6ffc79865108279a74fd57d9070a17",
              "status": "affected",
              "version": "7fdc48cc63a30fa3480d18bdd8c5fff2b9b15212",
              "versionType": "git"
            },
            {
              "lessThan": "472dd7ea5e19a1aeabf1711ddc756777e05ee7c2",
              "status": "affected",
              "version": "7fdc48cc63a30fa3480d18bdd8c5fff2b9b15212",
              "versionType": "git"
            },
            {
              "lessThan": "6e516faf04317db2c46cbec4e3b78b4653a5b109",
              "status": "affected",
              "version": "7fdc48cc63a30fa3480d18bdd8c5fff2b9b15212",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c29485e34e63198dca6289639aa711f99d88e76e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "626adede2642f00c8918999a2451bd0a644ab9b7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cf461fa9250a634e8afc4433d82ae0decea8136e",
              "versionType": "git"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.67",
              "versionType": "semver"
            },
            {
              "lessThan": "5.14",
              "status": "affected",
              "version": "5.13.19",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15",
              "status": "affected",
              "version": "5.14.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panfrost/panfrost_drv.c",
            "drivers/gpu/drm/panfrost/panfrost_job.c",
            "drivers/gpu/drm/panfrost/panfrost_job.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.15",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.4",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.67",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.13.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.14.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panfrost: Job should reference MMU not file_priv\n\nFor a while now it\u0027s been allowed for a MMU context to outlive it\u0027s\ncorresponding panfrost_priv, however the job structure still references\npanfrost_priv to get hold of the MMU context. If panfrost_priv has been\nfreed this is a use-after-free which I\u0027ve been able to trigger resulting\nin a splat.\n\nTo fix this, drop the reference to panfrost_priv in the job structure\nand add a direct reference to the MMU structure which is what\u0027s actually\nneeded."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached via DRM ioctls (DRM_IOCTL_PANFROST_SUBMIT) and close() on the Panfrost render node (/dev/dri/renderD*), which requires local process access to the device file rather than network or adjacent-network input.\nAC:L - An attacker controls both sides by submitting GPU jobs then closing the FD; panfrost_postclose frees file_priv while in-flight/hard-stopped jobs still dereference it on the IRQ completion path, and the author reproduced the UAF splat without depending on uncontrolled conditions.\nPR:L - Panfrost ioctls are marked DRM_RENDER_ALLOW on a render node that grants GPU access to unprivileged clients (e.g., Android apps or desktop users with render-node access) without root or DRM master authentication.\nUI:N - The attacker opens the render node, submits jobs, and closes their own FD; no separate victim action is required.\nS:U - Impact is confined to the host kernel authority (heap UAF / potential local privilege escalation); this is not a VM escape or IOMMU/DMA security-boundary bypass.\nC:H - Use-after-free of panfrost_file_priv lets an attacker reclaim the object and corrupt the mmu pointer used by panfrost_mmu_as_get/put, enabling arbitrary kernel memory disclosure per UAF exploitation guidance.\nI:H - The same reclaimed file_priv/MMU pointer is consumed by job submit and IRQ completion paths that mutate MMU address-space state, yielding a controllable write/control-flow primitive suitable for integrity compromise and code execution.\nA:H - Dereferencing the freed file_priv causes a kernel oops/splat (as reported by the fix author) and can panic or hang the system, which is High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:54:53.388Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8c8e8cc91a6ffc79865108279a74fd57d9070a17"
        },
        {
          "url": "https://git.kernel.org/stable/c/472dd7ea5e19a1aeabf1711ddc756777e05ee7c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e516faf04317db2c46cbec4e3b78b4653a5b109"
        }
      ],
      "title": "drm/panfrost: Job should reference MMU not file_priv",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49359",
    "datePublished": "2025-02-26T02:11:07.930Z",
    "dateReserved": "2025-02-26T02:08:31.546Z",
    "dateUpdated": "2026-08-05T08:54:53.388Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49359",
      "date": "2026-09-16",
      "epss": "0.00265",
      "percentile": "0.18555"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T15:13:31.000Z",
      "cve": "CVE-2022-49359",
      "id": "msrc_CVE-2022-49359",
      "initial_release_date": "2025-02-02T00:00:00.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/panfrost: Job should reference MMU not file_priv",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2022-49359.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49359\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:12.583\",\"lastModified\":\"2026-06-17T05:17:49.290\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/panfrost: Job should reference MMU not file_priv\\n\\nFor a while now it\u0027s been allowed for a MMU context to outlive it\u0027s\\ncorresponding panfrost_priv, however the job structure still references\\npanfrost_priv to get hold of the MMU context. If panfrost_priv has been\\nfreed this is a use-after-free which I\u0027ve been able to trigger resulting\\nin a splat.\\n\\nTo fix this, drop the reference to panfrost_priv in the job structure\\nand add a direct reference to the MMU structure which is what\u0027s actually\\nneeded.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/panfrost: El trabajo debe hacer referencia a MMU, no a file_priv Desde hace un tiempo se ha permitido que un contexto MMU sobreviva a su panfrost_priv correspondiente, sin embargo, la estructura del trabajo a\u00fan hace referencia a panfrost_priv para obtener el contexto MMU. Si panfrost_priv se ha liberado, se trata de un use-after-free que he podido activar, lo que ha dado como resultado un splat. Para solucionar esto, elimine la referencia a panfrost_priv en la estructura del trabajo y agregue una referencia directa a la estructura MMU, que es lo que realmente se necesita.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/panfrost/panfrost_drv.c\",\"drivers/gpu/drm/panfrost/panfrost_job.c\",\"drivers/gpu/drm/panfrost/panfrost_job.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7fdc48cc63a30fa3480d18bdd8c5fff2b9b15212\",\"lessThan\":\"8c8e8cc91a6ffc79865108279a74fd57d9070a17\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7fdc48cc63a30fa3480d18bdd8c5fff2b9b15212\",\"lessThan\":\"472dd7ea5e19a1aeabf1711ddc756777e05ee7c2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7fdc48cc63a30fa3480d18bdd8c5fff2b9b15212\",\"lessThan\":\"6e516faf04317db2c46cbec4e3b78b4653a5b109\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c29485e34e63198dca6289639aa711f99d88e76e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"626adede2642f00c8918999a2451bd0a644ab9b7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cf461fa9250a634e8afc4433d82ae0decea8136e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.67\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.13.19\",\"lessThan\":\"5.14\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.14.6\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/panfrost/panfrost_drv.c\",\"drivers/gpu/drm/panfrost/panfrost_job.c\",\"drivers/gpu/drm/panfrost/panfrost_job.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17.15\",\"lessThanOrEqual\":\"5.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18.4\",\"lessThanOrEqual\":\"5.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-27T18:16:38.134749Z\",\"id\":\"CVE-2022-49359\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.67\",\"versionEndExcluding\":\"5.11\",\"matchCriteriaId\":\"7A76EA36-1A32-42E8-93FC-BF561EE04439\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.13.19\",\"versionEndExcluding\":\"5.14\",\"matchCriteriaId\":\"097A0850-FAA6-4FFF-88C2-F5B49B5CE740\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.14.6\",\"versionEndExcluding\":\"5.17.15\",\"matchCriteriaId\":\"87B23815-EF6B-44C0-93AF-C7D1ABA2C903\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"5.18.4\",\"matchCriteriaId\":\"FA6D643C-6D6A-4821-8A8D-B5776B8F0103\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"A8C30C2D-F82D-4D37-AB48-D76ABFBD5377\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/472dd7ea5e19a1aeabf1711ddc756777e05ee7c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6e516faf04317db2c46cbec4e3b78b4653a5b109\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8c8e8cc91a6ffc79865108279a74fd57d9070a17\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-06-29T20:17:58+00:00",
      "cve": "CVE-2022-49359",
      "id": "CVE-2022-49359",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/panfrost: Job should reference MMU not file_priv",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49359.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-05T17:06:48Z",
      "cve": "CVE-2022-49359",
      "id": "CVE-2022-49359",
      "initial_release_date": "2025-02-27T03:08:12Z",
      "product_status:known_affected": "425",
      "product_status:known_not_affected": "344",
      "product_status:recommended": "100",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49359",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49359.json",
      "version": "40"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-49359\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-27T18:16:38.134749Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-27T18:16:39.755Z\"}}], \"cna\": {\"title\": \"drm/panfrost: Job should reference MMU not file_priv\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7fdc48cc63a30fa3480d18bdd8c5fff2b9b15212\", \"lessThan\": \"8c8e8cc91a6ffc79865108279a74fd57d9070a17\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7fdc48cc63a30fa3480d18bdd8c5fff2b9b15212\", \"lessThan\": \"472dd7ea5e19a1aeabf1711ddc756777e05ee7c2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7fdc48cc63a30fa3480d18bdd8c5fff2b9b15212\", \"lessThan\": \"6e516faf04317db2c46cbec4e3b78b4653a5b109\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c29485e34e63198dca6289639aa711f99d88e76e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"626adede2642f00c8918999a2451bd0a644ab9b7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"cf461fa9250a634e8afc4433d82ae0decea8136e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.10.67\", \"lessThan\": \"5.11\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.13.19\", \"lessThan\": \"5.14\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.14.6\", \"lessThan\": \"5.15\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/gpu/drm/panfrost/panfrost_drv.c\", \"drivers/gpu/drm/panfrost/panfrost_job.c\", \"drivers/gpu/drm/panfrost/panfrost_job.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.15\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.17.15\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.17.*\"}, {\"status\": \"unaffected\", \"version\": \"5.18.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.18.*\"}, {\"status\": \"unaffected\", \"version\": \"5.19\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/panfrost/panfrost_drv.c\", \"drivers/gpu/drm/panfrost/panfrost_job.c\", \"drivers/gpu/drm/panfrost/panfrost_job.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8c8e8cc91a6ffc79865108279a74fd57d9070a17\"}, {\"url\": \"https://git.kernel.org/stable/c/472dd7ea5e19a1aeabf1711ddc756777e05ee7c2\"}, {\"url\": \"https://git.kernel.org/stable/c/6e516faf04317db2c46cbec4e3b78b4653a5b109\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/panfrost: Job should reference MMU not file_priv\\n\\nFor a while now it\u0027s been allowed for a MMU context to outlive it\u0027s\\ncorresponding panfrost_priv, however the job structure still references\\npanfrost_priv to get hold of the MMU context. If panfrost_priv has been\\nfreed this is a use-after-free which I\u0027ve been able to trigger resulting\\nin a splat.\\n\\nTo fix this, drop the reference to panfrost_priv in the job structure\\nand add a direct reference to the MMU structure which is what\u0027s actually\\nneeded.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17.15\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.18.4\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.19\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.10.67\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.13.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.14.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:21:58.834Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-49359\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:21:58.834Z\", \"dateReserved\": \"2025-02-26T02:08:31.546Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-26T02:11:07.930Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.