CVE-2022-48872

HighCVSS 7.0/10Last modified Aug 4, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

misc: fastrpc: Fix use-after-free race condition for maps

It is possible that in between calling fastrpc_map_get() until map->fl->lock is taken in fastrpc_free_map(), another thread can call fastrpc_map_lookup() and get a reference to a map that is about to be deleted.

Rewrite fastrpc_map_get() to only increase the reference count of a map if it's non-zero. Propagate this to callers so they can know if a map is about to be deleted.

Fixes this warning: refcount_t: addition on 0; use-after-free. WARNING: CPU: 5 PID: 10100 at lib/refcount.c:25 refcount_warn_saturate ... Call trace: refcount_warn_saturate [fastrpc_map_get inlined] [fastrpc_map_lookup inlined] fastrpc_map_create fastrpc_internal_invoke fastrpc_device_ioctl __arm64_sys_ioctl invoke_syscall

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
LinuxLinux>= c68cfb718c8f97b7f7a50ed66be5feb42d0c8988, < 556dfdb226ce1e5231d8836159b23f8bb0395bf4; >= c68cfb718c8f97b7f7a50ed66be5feb42d0c8988, < b171d0d2cf1b8387c72c8d325c5d5746fa271e39; >= c68cfb718c8f97b7f7a50ed66be5feb42d0c8988, < 61a0890cb95afec5c8a2f4a879de2b6220984ef1; >= c68cfb718c8f97b7f7a50ed66be5feb42d0c8988, < 079c78c68714f7d8d58e66c477b0243b31806907; >= c68cfb718c8f97b7f7a50ed66be5feb42d0c8988, < 96b328d119eca7563c1edcc4e1039a62e6370ecb
LinuxLinux5.1

References

Timeline

Published
Aug 21, 2024
Last modified
Aug 4, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-488737.8In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Don't remove map on creater_process and device_release CVE-2022-488747.8In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix use-after-free and race in fastrpc_map_find CurrentCVE-2022-488755.5In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: sdata can be NULL during AMPDU start ieee80211_tx_ba_sCVE-2022-488765.5In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix initialization of rx->link and rx->link_sta There CVE-2022-488787.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_qca: Fix driver shutdown on closed serdev The driver shCVE-2022-488795.5In the Linux kernel, the following vulnerability has been resolved: efi: fix NULL-deref in init error path In cases where runtime servicesCVE-2022-48886.5The Checkout Fields Manager WordPress plugin before 1.0.2, Abandoned Cart Recovery WordPress plugin before 1.2.5, Custom Fields for WooCommeCVE-2022-488805.5In the Linux kernel, the following vulnerability has been resolved: platform/surface: aggregator: Add missing call to ssam_request_sync_freCVE-2022-488817.1In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd: Fix refcount leak in amd_pmc_probe pci_get_domain_buCVE-2022-488825.5In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix macsec possible null dereference when updating MAC securCVE-2022-488837.8In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parentCVE-2022-488845.5In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix command stats access after free Command may fail while d
CVE-2022-48872: High severity, CVSS 7.0 | Vulnix