CVE-2022-49935 (GCVE-0-2022-49935)

Vulnerability from cvelistv5 – Published: 2025-06-18 10:54 – Updated: 2026-08-05 08:56
VLAI
Title
dma-buf/dma-resv: check if the new fence is really later
Summary
In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-resv: check if the new fence is really later Previously when we added a fence to a dma_resv object we always assumed the the newer than all the existing fences. With Jason's work to add an UAPI to explicit export/import that's not necessary the case any more. So without this check we would allow userspace to force the kernel into an use after free error. Since the change is very small and defensive it's probably a good idea to backport this to stable kernels as well just in case others are using the dma_resv object in the same way.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 27836b641c1bf693c96c627388497b4e0f57441b , < c4c798fe98adceb642050819cb57cbc8f5c27870 (git)
Affected: 27836b641c1bf693c96c627388497b4e0f57441b , < a3f7c10a269d5b77dd5822ade822643ced3057f0 (git)
Create a notification for this product.
Linux Linux Affected: 5.0
Unaffected: 0 , < 5.0 (semver)
Unaffected: 5.19.8 , ≤ 5.19.* (semver)
Unaffected: 6.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma-buf/dma-resv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c4c798fe98adceb642050819cb57cbc8f5c27870",
              "status": "affected",
              "version": "27836b641c1bf693c96c627388497b4e0f57441b",
              "versionType": "git"
            },
            {
              "lessThan": "a3f7c10a269d5b77dd5822ade822643ced3057f0",
              "status": "affected",
              "version": "27836b641c1bf693c96c627388497b4e0f57441b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma-buf/dma-resv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.8",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-buf/dma-resv: check if the new fence is really later\n\nPreviously when we added a fence to a dma_resv object we always\nassumed the the newer than all the existing fences.\n\nWith Jason\u0027s work to add an UAPI to explicit export/import that\u0027s not\nnecessary the case any more. So without this check we would allow\nuserspace to force the kernel into an use after free error.\n\nSince the change is very small and defensive it\u0027s probably a good\nidea to backport this to stable kernels as well just in case others\nare using the dma_resv object in the same way."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered via DMA_BUF_IOCTL_IMPORT_SYNC_FILE on a local dma-buf file descriptor (ioctl path in dma_buf_import_sync_file \u2192 dma_resv_add_fence), not via network packet processing.\nAC:L - An attacker fully controls the fence timeline by exporting an older sync_file, submitting newer GPU work, then re-importing the older fence; no conditions outside attacker control are required.\nPR:L - Any unprivileged local user who can obtain a dma-buf fd (DRM render node, Android graphics client, dma-heap) can call the import ioctl with no capability checks on the path.\nUI:N - Exploitation uses the attacker\u0027s own dma-buf and sync_file fds; no action by another user is required.\nS:U - This is a standard in-kernel use-after-free within the host kernel\u0027s authority (dma-buf/GPU memory management), not a VM escape or IOMMU boundary crossing.\nC:H - The commit states userspace can force a use-after-free; UAF of buffer backing pages enables arbitrary kernel memory disclosure.\nI:H - Premature reclaim while GPU DMA continues yields a classic heap UAF primitive usable for arbitrary writes and control-flow hijacking.\nA:H - The same UAF/synchronization failure can crash or hang the kernel (oops/panic) even when not fully exploited for code execution."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:56:47.132Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c4c798fe98adceb642050819cb57cbc8f5c27870"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3f7c10a269d5b77dd5822ade822643ced3057f0"
        }
      ],
      "title": "dma-buf/dma-resv: check if the new fence is really later",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49935",
    "datePublished": "2025-06-18T10:54:36.963Z",
    "dateReserved": "2025-05-01T14:05:17.255Z",
    "dateUpdated": "2026-08-05T08:56:47.132Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49935",
      "date": "2026-08-11",
      "epss": "0.00148",
      "percentile": "0.04498"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49935\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-06-18T11:15:20.340\",\"lastModified\":\"2026-08-04T10:18:00.177\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndma-buf/dma-resv: check if the new fence is really later\\n\\nPreviously when we added a fence to a dma_resv object we always\\nassumed the the newer than all the existing fences.\\n\\nWith Jason\u0027s work to add an UAPI to explicit export/import that\u0027s not\\nnecessary the case any more. So without this check we would allow\\nuserspace to force the kernel into an use after free error.\\n\\nSince the change is very small and defensive it\u0027s probably a good\\nidea to backport this to stable kernels as well just in case others\\nare using the dma_resv object in the same way.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dma-buf/dma-resv: comprobar si la nueva valla es realmente posterior. Anteriormente, al a\u00f1adir una valla a un objeto dma_resv, siempre supon\u00edamos que era m\u00e1s reciente que todas las vallas existentes. Gracias al trabajo de Jason para a\u00f1adir una UAPI a la exportaci\u00f3n/importaci\u00f3n expl\u00edcita, esto ya no es necesario. Por lo tanto, sin esta comprobaci\u00f3n, permitir\u00edamos que el espacio de usuario forzara al kernel a un error de Use-After-Free. Dado que el cambio es muy peque\u00f1o y defensivo, probablemente sea buena idea retroportarlo tambi\u00e9n a los kernels estables, por si acaso otros utilizan el objeto dma_resv de la misma manera.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/dma-buf/dma-resv.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"27836b641c1bf693c96c627388497b4e0f57441b\",\"lessThan\":\"c4c798fe98adceb642050819cb57cbc8f5c27870\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"27836b641c1bf693c96c627388497b4e0f57441b\",\"lessThan\":\"a3f7c10a269d5b77dd5822ade822643ced3057f0\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/dma-buf/dma-resv.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19.8\",\"lessThanOrEqual\":\"5.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.0\",\"versionEndExcluding\":\"5.19.8\",\"matchCriteriaId\":\"40609647-0783-4105-9869-6AF27151B4D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E8BD11A3-8643-49B6-BADE-5029A0117325\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F0AD220-F6A9-4012-8636-155F1B841FAD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"A46498B3-78E1-4623-AAE1-94D29A42BE4E\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/a3f7c10a269d5b77dd5822ade822643ced3057f0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c4c798fe98adceb642050819cb57cbc8f5c27870\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:42:52+00:00",
      "cve": "CVE-2022-49935",
      "id": "CVE-2022-49935",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "321",
      "product_status:known_affected": "38",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: dma-buf/dma-resv: check if the new fence is really later",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49935.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T01:12:16Z",
      "cve": "CVE-2022-49935",
      "id": "CVE-2022-49935",
      "initial_release_date": "2025-06-19T03:46:09Z",
      "product_status:known_affected": "461",
      "product_status:known_not_affected": "255",
      "product_status:recommended": "139",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49935",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49935.json",
      "version": "31"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.