CVE-2022-50332 (GCVE-0-2022-50332)
Vulnerability from cvelistv5
Published
2025-09-15 14:49
Modified
2025-09-15 14:49
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: video/aperture: Call sysfb_disable() before removing PCI devices Call sysfb_disable() from aperture_remove_conflicting_pci_devices() before removing PCI devices. Without, simpledrm can still bind to simple-framebuffer devices after the hardware driver has taken over the hardware. Both drivers interfere with each other and results are undefined. Reported modesetting errors [1] are shown below. ---- snap ---- rcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { 13-.... } 7 jiffies s: 165 root: 0x2000/. rcu: blocking rcu_node structures (internal RCU debug): Task dump for CPU 13: task:X state:R running task stack: 0 pid: 4242 ppid: 4228 flags:0x00000008 Call Trace: <TASK> ? commit_tail+0xd7/0x130 ? drm_atomic_helper_commit+0x126/0x150 ? drm_atomic_commit+0xa4/0xe0 ? drm_plane_get_damage_clips.cold+0x1c/0x1c ? drm_atomic_helper_dirtyfb+0x19e/0x280 ? drm_mode_dirtyfb_ioctl+0x10f/0x1e0 ? drm_mode_getfb2_ioctl+0x2d0/0x2d0 ? drm_ioctl_kernel+0xc4/0x150 ? drm_ioctl+0x246/0x3f0 ? drm_mode_getfb2_ioctl+0x2d0/0x2d0 ? __x64_sys_ioctl+0x91/0xd0 ? do_syscall_64+0x60/0xd0 ? entry_SYSCALL_64_after_hwframe+0x4b/0xb5 </TASK> ... rcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { 13-.... } 30 jiffies s: 169 root: 0x2000/. rcu: blocking rcu_node structures (internal RCU debug): Task dump for CPU 13: task:X state:R running task stack: 0 pid: 4242 ppid: 4228 flags:0x0000400e Call Trace: <TASK> ? memcpy_toio+0x76/0xc0 ? memcpy_toio+0x1b/0xc0 ? drm_fb_memcpy_toio+0x76/0xb0 ? drm_fb_blit_toio+0x75/0x2b0 ? simpledrm_simple_display_pipe_update+0x132/0x150 ? drm_atomic_helper_commit_planes+0xb6/0x230 ? drm_atomic_helper_commit_tail+0x44/0x80 ? commit_tail+0xd7/0x130 ? drm_atomic_helper_commit+0x126/0x150 ? drm_atomic_commit+0xa4/0xe0 ? drm_plane_get_damage_clips.cold+0x1c/0x1c ? drm_atomic_helper_dirtyfb+0x19e/0x280 ? drm_mode_dirtyfb_ioctl+0x10f/0x1e0 ? drm_mode_getfb2_ioctl+0x2d0/0x2d0 ? drm_ioctl_kernel+0xc4/0x150 ? drm_ioctl+0x246/0x3f0 ? drm_mode_getfb2_ioctl+0x2d0/0x2d0 ? __x64_sys_ioctl+0x91/0xd0 ? do_syscall_64+0x60/0xd0 ? entry_SYSCALL_64_after_hwframe+0x4b/0xb5 </TASK> The problem was added by commit 5e0137612430 ("video/aperture: Disable and unregister sysfb devices via aperture helpers") to v6.0.3 and does not exist in the mainline branch. The mainline commit 5e0137612430 ("video/aperture: Disable and unregister sysfb devices via aperture helpers") has been backported from v6.0-rc1 to stable v6.0.3 from a larger patch series [2] that reworks fbdev framebuffer ownership. The backport misses a change to aperture_remove_conflicting_pci_devices(). Mainline itself is fine, because the function does not exist there as a result of the patch series. Instead of backporting the whole series, fix the additional function.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/25a6688f27ff54f97adf7cce1d7e18c38bf51eb4
Impacted products
Vendor Product Version
Linux Linux Version: cfecfc98a78d97a49807531b5b224459bda877de
 Create a notification for this product.
   Linux Linux Version: 6.0.3   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/aperture.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "25a6688f27ff54f97adf7cce1d7e18c38bf51eb4",
              "status": "affected",
              "version": "cfecfc98a78d97a49807531b5b224459bda877de",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/aperture.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.0.6",
              "status": "affected",
              "version": "6.0.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.6",
                  "versionStartIncluding": "6.0.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvideo/aperture: Call sysfb_disable() before removing PCI devices\n\nCall sysfb_disable() from aperture_remove_conflicting_pci_devices()\nbefore removing PCI devices. Without, simpledrm can still bind to\nsimple-framebuffer devices after the hardware driver has taken over\nthe hardware. Both drivers interfere with each other and results are\nundefined.\n\nReported modesetting errors [1] are shown below.\n\n---- snap ----\nrcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { 13-.... } 7 jiffies s: 165 root: 0x2000/.\nrcu: blocking rcu_node structures (internal RCU debug):\nTask dump for CPU 13:\ntask:X               state:R  running task     stack:    0 pid: 4242 ppid:  4228 flags:0x00000008\nCall Trace:\n \u003cTASK\u003e\n ? commit_tail+0xd7/0x130\n ? drm_atomic_helper_commit+0x126/0x150\n ? drm_atomic_commit+0xa4/0xe0\n ? drm_plane_get_damage_clips.cold+0x1c/0x1c\n ? drm_atomic_helper_dirtyfb+0x19e/0x280\n ? drm_mode_dirtyfb_ioctl+0x10f/0x1e0\n ? drm_mode_getfb2_ioctl+0x2d0/0x2d0\n ? drm_ioctl_kernel+0xc4/0x150\n ? drm_ioctl+0x246/0x3f0\n ? drm_mode_getfb2_ioctl+0x2d0/0x2d0\n ? __x64_sys_ioctl+0x91/0xd0\n ? do_syscall_64+0x60/0xd0\n ? entry_SYSCALL_64_after_hwframe+0x4b/0xb5\n \u003c/TASK\u003e\n...\nrcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { 13-.... } 30 jiffies s: 169 root: 0x2000/.\nrcu: blocking rcu_node structures (internal RCU debug):\nTask dump for CPU 13:\ntask:X               state:R  running task     stack:    0 pid: 4242 ppid:  4228 flags:0x0000400e\nCall Trace:\n \u003cTASK\u003e\n ? memcpy_toio+0x76/0xc0\n ? memcpy_toio+0x1b/0xc0\n ? drm_fb_memcpy_toio+0x76/0xb0\n ? drm_fb_blit_toio+0x75/0x2b0\n ? simpledrm_simple_display_pipe_update+0x132/0x150\n ? drm_atomic_helper_commit_planes+0xb6/0x230\n ? drm_atomic_helper_commit_tail+0x44/0x80\n ? commit_tail+0xd7/0x130\n ? drm_atomic_helper_commit+0x126/0x150\n ? drm_atomic_commit+0xa4/0xe0\n ? drm_plane_get_damage_clips.cold+0x1c/0x1c\n ? drm_atomic_helper_dirtyfb+0x19e/0x280\n ? drm_mode_dirtyfb_ioctl+0x10f/0x1e0\n ? drm_mode_getfb2_ioctl+0x2d0/0x2d0\n ? drm_ioctl_kernel+0xc4/0x150\n ? drm_ioctl+0x246/0x3f0\n ? drm_mode_getfb2_ioctl+0x2d0/0x2d0\n ? __x64_sys_ioctl+0x91/0xd0\n ? do_syscall_64+0x60/0xd0\n ? entry_SYSCALL_64_after_hwframe+0x4b/0xb5\n \u003c/TASK\u003e\n\nThe problem was added by commit 5e0137612430 (\"video/aperture: Disable\nand unregister sysfb devices via aperture helpers\") to v6.0.3 and does\nnot exist in the mainline branch.\n\nThe mainline commit 5e0137612430 (\"video/aperture: Disable and\nunregister sysfb devices via aperture helpers\") has been backported\nfrom v6.0-rc1 to stable v6.0.3 from a larger patch series [2] that\nreworks fbdev framebuffer ownership. The backport misses a change to\naperture_remove_conflicting_pci_devices(). Mainline itself is fine,\nbecause the function does not exist there as a result of the patch\nseries.\n\nInstead of backporting the whole series, fix the additional function."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-15T14:49:42.733Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/25a6688f27ff54f97adf7cce1d7e18c38bf51eb4"
        }
      ],
      "title": "video/aperture: Call sysfb_disable() before removing PCI devices",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50332",
    "datePublished": "2025-09-15T14:49:42.733Z",
    "dateReserved": "2025-09-15T14:18:36.816Z",
    "dateUpdated": "2025-09-15T14:49:42.733Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50332\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-15T15:15:45.427\",\"lastModified\":\"2025-09-15T15:22:27.090\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvideo/aperture: Call sysfb_disable() before removing PCI devices\\n\\nCall sysfb_disable() from aperture_remove_conflicting_pci_devices()\\nbefore removing PCI devices. Without, simpledrm can still bind to\\nsimple-framebuffer devices after the hardware driver has taken over\\nthe hardware. Both drivers interfere with each other and results are\\nundefined.\\n\\nReported modesetting errors [1] are shown below.\\n\\n---- snap ----\\nrcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { 13-.... } 7 jiffies s: 165 root: 0x2000/.\\nrcu: blocking rcu_node structures (internal RCU debug):\\nTask dump for CPU 13:\\ntask:X               state:R  running task     stack:    0 pid: 4242 ppid:  4228 flags:0x00000008\\nCall Trace:\\n \u003cTASK\u003e\\n ? commit_tail+0xd7/0x130\\n ? drm_atomic_helper_commit+0x126/0x150\\n ? drm_atomic_commit+0xa4/0xe0\\n ? drm_plane_get_damage_clips.cold+0x1c/0x1c\\n ? drm_atomic_helper_dirtyfb+0x19e/0x280\\n ? drm_mode_dirtyfb_ioctl+0x10f/0x1e0\\n ? drm_mode_getfb2_ioctl+0x2d0/0x2d0\\n ? drm_ioctl_kernel+0xc4/0x150\\n ? drm_ioctl+0x246/0x3f0\\n ? drm_mode_getfb2_ioctl+0x2d0/0x2d0\\n ? __x64_sys_ioctl+0x91/0xd0\\n ? do_syscall_64+0x60/0xd0\\n ? entry_SYSCALL_64_after_hwframe+0x4b/0xb5\\n \u003c/TASK\u003e\\n...\\nrcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { 13-.... } 30 jiffies s: 169 root: 0x2000/.\\nrcu: blocking rcu_node structures (internal RCU debug):\\nTask dump for CPU 13:\\ntask:X               state:R  running task     stack:    0 pid: 4242 ppid:  4228 flags:0x0000400e\\nCall Trace:\\n \u003cTASK\u003e\\n ? memcpy_toio+0x76/0xc0\\n ? memcpy_toio+0x1b/0xc0\\n ? drm_fb_memcpy_toio+0x76/0xb0\\n ? drm_fb_blit_toio+0x75/0x2b0\\n ? simpledrm_simple_display_pipe_update+0x132/0x150\\n ? drm_atomic_helper_commit_planes+0xb6/0x230\\n ? drm_atomic_helper_commit_tail+0x44/0x80\\n ? commit_tail+0xd7/0x130\\n ? drm_atomic_helper_commit+0x126/0x150\\n ? drm_atomic_commit+0xa4/0xe0\\n ? drm_plane_get_damage_clips.cold+0x1c/0x1c\\n ? drm_atomic_helper_dirtyfb+0x19e/0x280\\n ? drm_mode_dirtyfb_ioctl+0x10f/0x1e0\\n ? drm_mode_getfb2_ioctl+0x2d0/0x2d0\\n ? drm_ioctl_kernel+0xc4/0x150\\n ? drm_ioctl+0x246/0x3f0\\n ? drm_mode_getfb2_ioctl+0x2d0/0x2d0\\n ? __x64_sys_ioctl+0x91/0xd0\\n ? do_syscall_64+0x60/0xd0\\n ? entry_SYSCALL_64_after_hwframe+0x4b/0xb5\\n \u003c/TASK\u003e\\n\\nThe problem was added by commit 5e0137612430 (\\\"video/aperture: Disable\\nand unregister sysfb devices via aperture helpers\\\") to v6.0.3 and does\\nnot exist in the mainline branch.\\n\\nThe mainline commit 5e0137612430 (\\\"video/aperture: Disable and\\nunregister sysfb devices via aperture helpers\\\") has been backported\\nfrom v6.0-rc1 to stable v6.0.3 from a larger patch series [2] that\\nreworks fbdev framebuffer ownership. The backport misses a change to\\naperture_remove_conflicting_pci_devices(). Mainline itself is fine,\\nbecause the function does not exist there as a result of the patch\\nseries.\\n\\nInstead of backporting the whole series, fix the additional function.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/25a6688f27ff54f97adf7cce1d7e18c38bf51eb4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.