GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49053 (GCVE-0-2022-49053)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:54 – Updated: 2026-08-05 08:53
VLAI
Title
scsi: target: tcmu: Fix possible page UAF
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: target: tcmu: Fix possible page UAF tcmu_try_get_data_page() looks up pages under cmdr_lock, but it does not take refcount properly and just returns page pointer. When tcmu_try_get_data_page() returns, the returned page may have been freed by tcmu_blocks_release(). We need to get_page() under cmdr_lock to avoid concurrent tcmu_blocks_release().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-27 17:59 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 141685a39151aea95eb56562d2953e919c6c73da , < d7c5d79e50be6e06b669141e3db1f977a0dd4e8e (git)
Affected: 141685a39151aea95eb56562d2953e919c6c73da , < e3e0e067d5b34e4a68e3cc55f8eebc413f56f8ed (git)
Affected: 141685a39151aea95eb56562d2953e919c6c73da , < fb7a5115422fbd6a4d505e8844f1ef5529f10489 (git)
Affected: 141685a39151aea95eb56562d2953e919c6c73da , < aec36b98a1bbaa84bfd8299a306e4c12314af626 (git)
Affected: 141685a39151aea95eb56562d2953e919c6c73da , < b7f3b5d70c834f49f7d87a2f2ed1c6284d9a0322 (git)
Affected: 141685a39151aea95eb56562d2953e919c6c73da , < a9564d84ed9f6ee71017d062d0d2182154294a4b (git)
Affected: 141685a39151aea95eb56562d2953e919c6c73da , < a6968f7a367f128d120447360734344d5a3d5336 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.12
Unaffected: 0 , < 4.12 (semver)
Unaffected: 4.14.276 , ≤ 4.14.* (semver)
Unaffected: 4.19.239 , ≤ 4.19.* (semver)
Unaffected: 5.4.190 , ≤ 5.4.* (semver)
Unaffected: 5.10.112 , ≤ 5.10.* (semver)
Unaffected: 5.15.35 , ≤ 5.15.* (semver)
Unaffected: 5.17.4 , ≤ 5.17.* (semver)
Unaffected: 5.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49053",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T17:59:25.641949Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:02:30.241Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/target_core_user.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d7c5d79e50be6e06b669141e3db1f977a0dd4e8e",
              "status": "affected",
              "version": "141685a39151aea95eb56562d2953e919c6c73da",
              "versionType": "git"
            },
            {
              "lessThan": "e3e0e067d5b34e4a68e3cc55f8eebc413f56f8ed",
              "status": "affected",
              "version": "141685a39151aea95eb56562d2953e919c6c73da",
              "versionType": "git"
            },
            {
              "lessThan": "fb7a5115422fbd6a4d505e8844f1ef5529f10489",
              "status": "affected",
              "version": "141685a39151aea95eb56562d2953e919c6c73da",
              "versionType": "git"
            },
            {
              "lessThan": "aec36b98a1bbaa84bfd8299a306e4c12314af626",
              "status": "affected",
              "version": "141685a39151aea95eb56562d2953e919c6c73da",
              "versionType": "git"
            },
            {
              "lessThan": "b7f3b5d70c834f49f7d87a2f2ed1c6284d9a0322",
              "status": "affected",
              "version": "141685a39151aea95eb56562d2953e919c6c73da",
              "versionType": "git"
            },
            {
              "lessThan": "a9564d84ed9f6ee71017d062d0d2182154294a4b",
              "status": "affected",
              "version": "141685a39151aea95eb56562d2953e919c6c73da",
              "versionType": "git"
            },
            {
              "lessThan": "a6968f7a367f128d120447360734344d5a3d5336",
              "status": "affected",
              "version": "141685a39151aea95eb56562d2953e919c6c73da",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/target_core_user.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.276",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.239",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.276",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.239",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.190",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.112",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.35",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.4",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: tcmu: Fix possible page UAF\n\ntcmu_try_get_data_page() looks up pages under cmdr_lock, but it does not\ntake refcount properly and just returns page pointer. When\ntcmu_try_get_data_page() returns, the returned page may have been freed by\ntcmu_blocks_release().\n\nWe need to get_page() under cmdr_lock to avoid concurrent\ntcmu_blocks_release()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is triggered in tcmu_vma_fault() when a local process faults on the mmap\u0027d TCMU UIO device (/dev/uioX); network I/O can only drive reclaim, not the use side.\nAC:L - A malicious TCMU handler controls page faults on the mmap and can drive command completion/allocation patterns that schedule tcmu_blocks_release(), so both sides of the race are attacker-influenced and retryable.\nPR:L - Exploitation requires opening/mmap\u0027ing an existing TCMU UIO device and acting as (or replacing) the userspace handler; TCMU\u2019s design assumes a malicious handler and no capability check exists on the fault path beyond ordinary local device access.\nUI:N - No separate victim action is required; the attacker triggers faults and reclaim themselves once they have the mapped TCMU device.\nS:U - Impact is confined to the local kernel/host authority (memory corruption/privilege escalation); this is not a VM/IOMMU/sandbox boundary escape.\nC:H - Page UAF in the fault path can map a freed and reallocated page into userspace, enabling arbitrary kernel/user memory disclosure.\nI:H - The same UAF/page remap primitive enables heap spraying and arbitrary writes/control-flow hijacking in the kernel.\nA:H - Use-after-free of a page during fault handling can cause kernel oops/panic even without a full exploit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:53:37.868Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d7c5d79e50be6e06b669141e3db1f977a0dd4e8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3e0e067d5b34e4a68e3cc55f8eebc413f56f8ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb7a5115422fbd6a4d505e8844f1ef5529f10489"
        },
        {
          "url": "https://git.kernel.org/stable/c/aec36b98a1bbaa84bfd8299a306e4c12314af626"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7f3b5d70c834f49f7d87a2f2ed1c6284d9a0322"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9564d84ed9f6ee71017d062d0d2182154294a4b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6968f7a367f128d120447360734344d5a3d5336"
        }
      ],
      "title": "scsi: target: tcmu: Fix possible page UAF",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49053",
    "datePublished": "2025-02-26T01:54:26.806Z",
    "dateReserved": "2025-02-26T01:49:39.242Z",
    "dateUpdated": "2026-08-05T08:53:37.868Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49053",
      "date": "2026-09-16",
      "epss": "0.00277",
      "percentile": "0.20187"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49053\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:00:42.563\",\"lastModified\":\"2026-06-17T05:16:56.740\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: target: tcmu: Fix possible page UAF\\n\\ntcmu_try_get_data_page() looks up pages under cmdr_lock, but it does not\\ntake refcount properly and just returns page pointer. When\\ntcmu_try_get_data_page() returns, the returned page may have been freed by\\ntcmu_blocks_release().\\n\\nWe need to get_page() under cmdr_lock to avoid concurrent\\ntcmu_blocks_release().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: target: tcmu: Fix possible page UAF tcmu_try_get_data_page() busca p\u00e1ginas bajo cmdr_lock, pero no toma el recuento de referencias correctamente y solo devuelve el puntero de p\u00e1gina. Cuando tcmu_try_get_data_page() regresa, la p\u00e1gina devuelta puede haber sido liberada por tcmu_blocks_release(). Necesitamos get_page() bajo cmdr_lock para evitar tcmu_blocks_release() concurrente.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/target/target_core_user.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"141685a39151aea95eb56562d2953e919c6c73da\",\"lessThan\":\"d7c5d79e50be6e06b669141e3db1f977a0dd4e8e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"141685a39151aea95eb56562d2953e919c6c73da\",\"lessThan\":\"e3e0e067d5b34e4a68e3cc55f8eebc413f56f8ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"141685a39151aea95eb56562d2953e919c6c73da\",\"lessThan\":\"fb7a5115422fbd6a4d505e8844f1ef5529f10489\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"141685a39151aea95eb56562d2953e919c6c73da\",\"lessThan\":\"aec36b98a1bbaa84bfd8299a306e4c12314af626\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"141685a39151aea95eb56562d2953e919c6c73da\",\"lessThan\":\"b7f3b5d70c834f49f7d87a2f2ed1c6284d9a0322\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"141685a39151aea95eb56562d2953e919c6c73da\",\"lessThan\":\"a9564d84ed9f6ee71017d062d0d2182154294a4b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"141685a39151aea95eb56562d2953e919c6c73da\",\"lessThan\":\"a6968f7a367f128d120447360734344d5a3d5336\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/target/target_core_user.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.276\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.239\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.190\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.112\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.35\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17.4\",\"lessThanOrEqual\":\"5.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-27T17:59:25.641949Z\",\"id\":\"CVE-2022-49053\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.14.276\",\"matchCriteriaId\":\"3088C36B-F9EB-4609-A0D0-EB411E2E915B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.239\",\"matchCriteriaId\":\"712D9B45-4B53-4563-94B5-F758AFBBFB0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.190\",\"matchCriteriaId\":\"E0ADBA6D-47D8-4518-8D10-9B9196DE680B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.112\",\"matchCriteriaId\":\"0460A5D2-3024-497A-B799-23E025B91972\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.35\",\"matchCriteriaId\":\"05ABCC3F-88A9-47F9-9D40-8665747B2E43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.17.4\",\"matchCriteriaId\":\"E22C86CB-06CD-4D16-AB2A-F21EE8199262\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.18:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6AD94161-84BB-42E6-9882-4FC0C42E9FC1\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/a6968f7a367f128d120447360734344d5a3d5336\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a9564d84ed9f6ee71017d062d0d2182154294a4b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aec36b98a1bbaa84bfd8299a306e4c12314af626\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b7f3b5d70c834f49f7d87a2f2ed1c6284d9a0322\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d7c5d79e50be6e06b669141e3db1f977a0dd4e8e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e3e0e067d5b34e4a68e3cc55f8eebc413f56f8ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fb7a5115422fbd6a4d505e8844f1ef5529f10489\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T22:49:48+00:00",
      "cve": "CVE-2022-49053",
      "id": "CVE-2022-49053",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: target: tcmu: Fix possible page UAF",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49053.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-29T02:30:48Z",
      "cve": "CVE-2022-49053",
      "id": "CVE-2022-49053",
      "initial_release_date": "2025-02-27T03:13:01Z",
      "product_status:known_affected": "486",
      "product_status:known_not_affected": "111",
      "product_status:recommended": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49053",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49053.json",
      "version": "62"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-49053\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-27T17:59:25.641949Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-27T17:59:27.457Z\"}}], \"cna\": {\"title\": \"scsi: target: tcmu: Fix possible page UAF\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The UAF is triggered in tcmu_vma_fault() when a local process faults on the mmap\u0027d TCMU UIO device (/dev/uioX); network I/O can only drive reclaim, not the use side.\\nAC:L - A malicious TCMU handler controls page faults on the mmap and can drive command completion/allocation patterns that schedule tcmu_blocks_release(), so both sides of the race are attacker-influenced and retryable.\\nPR:L - Exploitation requires opening/mmap\u0027ing an existing TCMU UIO device and acting as (or replacing) the userspace handler; TCMU\\u2019s design assumes a malicious handler and no capability check exists on the fault path beyond ordinary local device access.\\nUI:N - No separate victim action is required; the attacker triggers faults and reclaim themselves once they have the mapped TCMU device.\\nS:U - Impact is confined to the local kernel/host authority (memory corruption/privilege escalation); this is not a VM/IOMMU/sandbox boundary escape.\\nC:H - Page UAF in the fault path can map a freed and reallocated page into userspace, enabling arbitrary kernel/user memory disclosure.\\nI:H - The same UAF/page remap primitive enables heap spraying and arbitrary writes/control-flow hijacking in the kernel.\\nA:H - Use-after-free of a page during fault handling can cause kernel oops/panic even without a full exploit.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"141685a39151aea95eb56562d2953e919c6c73da\", \"lessThan\": \"d7c5d79e50be6e06b669141e3db1f977a0dd4e8e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"141685a39151aea95eb56562d2953e919c6c73da\", \"lessThan\": \"e3e0e067d5b34e4a68e3cc55f8eebc413f56f8ed\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"141685a39151aea95eb56562d2953e919c6c73da\", \"lessThan\": \"fb7a5115422fbd6a4d505e8844f1ef5529f10489\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"141685a39151aea95eb56562d2953e919c6c73da\", \"lessThan\": \"aec36b98a1bbaa84bfd8299a306e4c12314af626\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"141685a39151aea95eb56562d2953e919c6c73da\", \"lessThan\": \"b7f3b5d70c834f49f7d87a2f2ed1c6284d9a0322\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"141685a39151aea95eb56562d2953e919c6c73da\", \"lessThan\": \"a9564d84ed9f6ee71017d062d0d2182154294a4b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"141685a39151aea95eb56562d2953e919c6c73da\", \"lessThan\": \"a6968f7a367f128d120447360734344d5a3d5336\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/target/target_core_user.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.12\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.12\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.14.276\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.239\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.190\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.112\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.35\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.17.*\"}, {\"status\": \"unaffected\", \"version\": \"5.18\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/target/target_core_user.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d7c5d79e50be6e06b669141e3db1f977a0dd4e8e\"}, {\"url\": \"https://git.kernel.org/stable/c/e3e0e067d5b34e4a68e3cc55f8eebc413f56f8ed\"}, {\"url\": \"https://git.kernel.org/stable/c/fb7a5115422fbd6a4d505e8844f1ef5529f10489\"}, {\"url\": \"https://git.kernel.org/stable/c/aec36b98a1bbaa84bfd8299a306e4c12314af626\"}, {\"url\": \"https://git.kernel.org/stable/c/b7f3b5d70c834f49f7d87a2f2ed1c6284d9a0322\"}, {\"url\": \"https://git.kernel.org/stable/c/a9564d84ed9f6ee71017d062d0d2182154294a4b\"}, {\"url\": \"https://git.kernel.org/stable/c/a6968f7a367f128d120447360734344d5a3d5336\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: target: tcmu: Fix possible page UAF\\n\\ntcmu_try_get_data_page() looks up pages under cmdr_lock, but it does not\\ntake refcount properly and just returns page pointer. When\\ntcmu_try_get_data_page() returns, the returned page may have been freed by\\ntcmu_blocks_release().\\n\\nWe need to get_page() under cmdr_lock to avoid concurrent\\ntcmu_blocks_release().\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.14.276\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.239\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.190\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.112\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.35\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17.4\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.18\", \"versionStartIncluding\": \"4.12\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:53:37.868Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-49053\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:53:37.868Z\", \"dateReserved\": \"2025-02-26T01:49:39.242Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-26T01:54:26.806Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.