CVE-2022-48887 (GCVE-0-2022-48887)

Vulnerability from cvelistv5 – Published: 2024-08-21 06:10 – Updated: 2026-08-05 08:52
VLAI
Title
drm/vmwgfx: Remove rcu locks from user resources
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Remove rcu locks from user resources User resource lookups used rcu to avoid two extra atomics. Unfortunately the rcu paths were buggy and it was easy to make the driver crash by submitting command buffers from two different threads. Because the lookups never show up in performance profiles replace them with a regular spin lock which fixes the races in accesses to those shared resources. Fixes kernel oops'es in IGT's vmwgfx execution_buffer stress test and seen crashes with apps using shared resources.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:04 UTC
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: e14c02e6b6990e9f6ee18a214a22ac26bae1b25e , < 7ac9578e45b20e3f3c0c8eb71f5417a499a7226a (git)
Affected: e14c02e6b6990e9f6ee18a214a22ac26bae1b25e , < a309c7194e8a2f8bd4539b9449917913f6c2cd50 (git)
Create a notification for this product.
Linux Linux Affected: 4.20
Unaffected: 0 , < 4.20 (semver)
Unaffected: 6.1.7 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48887",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:04:35.491654Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:32:51.743Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/ttm_object.c",
            "drivers/gpu/drm/vmwgfx/ttm_object.h",
            "drivers/gpu/drm/vmwgfx/vmwgfx_bo.c",
            "drivers/gpu/drm/vmwgfx/vmwgfx_drv.h",
            "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c",
            "drivers/gpu/drm/vmwgfx/vmwgfx_resource.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7ac9578e45b20e3f3c0c8eb71f5417a499a7226a",
              "status": "affected",
              "version": "e14c02e6b6990e9f6ee18a214a22ac26bae1b25e",
              "versionType": "git"
            },
            {
              "lessThan": "a309c7194e8a2f8bd4539b9449917913f6c2cd50",
              "status": "affected",
              "version": "e14c02e6b6990e9f6ee18a214a22ac26bae1b25e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/ttm_object.c",
            "drivers/gpu/drm/vmwgfx/ttm_object.h",
            "drivers/gpu/drm/vmwgfx/vmwgfx_bo.c",
            "drivers/gpu/drm/vmwgfx/vmwgfx_drv.h",
            "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c",
            "drivers/gpu/drm/vmwgfx/vmwgfx_resource.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.7",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Remove rcu locks from user resources\n\nUser resource lookups used rcu to avoid two extra atomics. Unfortunately\nthe rcu paths were buggy and it was easy to make the driver crash by\nsubmitting command buffers from two different threads. Because the\nlookups never show up in performance profiles replace them with a\nregular spin lock which fixes the races in accesses to those shared\nresources.\n\nFixes kernel oops\u0027es in IGT\u0027s vmwgfx execution_buffer stress test and\nseen crashes with apps using shared resources."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reachable only via local DRM ioctls (DRM_IOCTL_VMW_EXECBUF and related resource create/destroy) on the vmwgfx render node (/dev/dri/renderD*), not via network or adjacent protocols.\nAC:L - The attacker controls both sides of the race by submitting command buffers from multiple threads and/or destroying shared user resources concurrently; the commit notes it was easy to trigger, with no conditions outside attacker control.\nPR:L - VMW_EXECBUF and resource ioctls are DRM_RENDER_ALLOW on a DRIVER_RENDER device, so any unprivileged local user who can open the render node can exercise the path without real root or init-namespace capabilities.\nUI:N - Exploitation uses only the attacker\u2019s own ioctls on the DRM fd; no victim action such as mounting, opening a crafted file, or interacting with the attacker is required.\nS:U - Impact is use-after-free / memory corruption inside the guest kernel\u2019s vmwgfx driver under the same OS security authority; this is not a VMware guest-to-host escape or other cross-boundary breakout.\nC:H - Buggy RCU noref lookups return TTM/user-resource pointers without taking a reference while a concurrent unref can tear down and free associated objects, yielding a heap UAF that can be leveraged for arbitrary kernel reads.\nI:H - The same UAF of shared DRM/TTM resource objects enables heap spray/reuse and control-flow hijacking primitives, consistent with treating exploitable use-after-free as High integrity impact.\nA:H - The race reliably produces kernel oopses (IGT vmwgfx execution_buffer stress test and apps using shared resources), which is full availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:52:48.345Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7ac9578e45b20e3f3c0c8eb71f5417a499a7226a"
        },
        {
          "url": "https://git.kernel.org/stable/c/a309c7194e8a2f8bd4539b9449917913f6c2cd50"
        }
      ],
      "title": "drm/vmwgfx: Remove rcu locks from user resources",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48887",
    "datePublished": "2024-08-21T06:10:19.073Z",
    "dateReserved": "2024-08-21T06:06:23.290Z",
    "dateUpdated": "2026-08-05T08:52:48.345Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48887",
      "date": "2026-10-04",
      "epss": "0.00247",
      "percentile": "0.14531"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/vmwgfx/ttm_object.c",
                  "drivers/gpu/drm/vmwgfx/ttm_object.h",
                  "drivers/gpu/drm/vmwgfx/vmwgfx_bo.c",
                  "drivers/gpu/drm/vmwgfx/vmwgfx_drv.h",
                  "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c",
                  "drivers/gpu/drm/vmwgfx/vmwgfx_resource.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "7ac9578e45b20e3f3c0c8eb71f5417a499a7226a",
                    "status": "affected",
                    "version": "e14c02e6b6990e9f6ee18a214a22ac26bae1b25e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a309c7194e8a2f8bd4539b9449917913f6c2cd50",
                    "status": "affected",
                    "version": "e14c02e6b6990e9f6ee18a214a22ac26bae1b25e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/vmwgfx/ttm_object.c",
                  "drivers/gpu/drm/vmwgfx/ttm_object.h",
                  "drivers/gpu/drm/vmwgfx/vmwgfx_bo.c",
                  "drivers/gpu/drm/vmwgfx/vmwgfx_drv.h",
                  "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c",
                  "drivers/gpu/drm/vmwgfx/vmwgfx_resource.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.20"
                  },
                  {
                    "lessThan": "4.20",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2D63FB2D-B092-4364-B732-F4FD54A43619",
                    "versionEndExcluding": "6.1.7",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "FF501633-2F44-4913-A8EE-B021929F49F6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "2BDA597B-CAC1-4DF0-86F0-42E142C654E9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "725C78C9-12CE-406F-ABE8-0813A01D66E8",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Remove rcu locks from user resources\n\nUser resource lookups used rcu to avoid two extra atomics. Unfortunately\nthe rcu paths were buggy and it was easy to make the driver crash by\nsubmitting command buffers from two different threads. Because the\nlookups never show up in performance profiles replace them with a\nregular spin lock which fixes the races in accesses to those shared\nresources.\n\nFixes kernel oops\u0027es in IGT\u0027s vmwgfx execution_buffer stress test and\nseen crashes with apps using shared resources."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: drm/vmwgfx: elimina los bloqueos de rcu de los recursos del usuario. Las b\u00fasquedas de recursos del usuario utilizaron rcu para evitar dos \u00e1tomos adicionales. Desafortunadamente, las rutas de rcu ten\u00edan errores y era f\u00e1cil hacer que el controlador fallara al enviar b\u00faferes de comando desde dos subprocesos diferentes. Debido a que las b\u00fasquedas nunca aparecen en los perfiles de rendimiento, reempl\u00e1celas con un bloqueo de giro normal que corrige las ejecuciones en los accesos a esos recursos compartidos. Corrige los fallos del kernel en la prueba de esfuerzo vmwgfxexecution_b\u00fafer de IGT y los fallos observados en las aplicaciones que utilizan recursos compartidos."
          }
        ],
        "id": "CVE-2022-48887",
        "lastModified": "2026-08-04T10:17:25.493",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-48887",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:04:35.491654Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-08-21T07:15:05.143",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7ac9578e45b20e3f3c0c8eb71f5417a499a7226a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a309c7194e8a2f8bd4539b9449917913f6c2cd50"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T23:01:05+00:00",
      "cve": "CVE-2022-48887",
      "id": "CVE-2022-48887",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "136",
      "product_status:known_not_affected": "62",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/vmwgfx: Remove rcu locks from user resources",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-48887.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-48887",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-10T16:04:35.491654Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-11T12:42:11.773Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/gpu/drm/vmwgfx/ttm_object.c",
                "drivers/gpu/drm/vmwgfx/ttm_object.h",
                "drivers/gpu/drm/vmwgfx/vmwgfx_bo.c",
                "drivers/gpu/drm/vmwgfx/vmwgfx_drv.h",
                "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c",
                "drivers/gpu/drm/vmwgfx/vmwgfx_resource.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "7ac9578e45b20e3f3c0c8eb71f5417a499a7226a",
                  "status": "affected",
                  "version": "e14c02e6b6990e9f6ee18a214a22ac26bae1b25e",
                  "versionType": "git"
                },
                {
                  "lessThan": "a309c7194e8a2f8bd4539b9449917913f6c2cd50",
                  "status": "affected",
                  "version": "e14c02e6b6990e9f6ee18a214a22ac26bae1b25e",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/gpu/drm/vmwgfx/ttm_object.c",
                "drivers/gpu/drm/vmwgfx/ttm_object.h",
                "drivers/gpu/drm/vmwgfx/vmwgfx_bo.c",
                "drivers/gpu/drm/vmwgfx/vmwgfx_drv.h",
                "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c",
                "drivers/gpu/drm/vmwgfx/vmwgfx_resource.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.20"
                },
                {
                  "lessThan": "4.20",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.7",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.2",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.7",
                      "versionStartIncluding": "4.20",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.2",
                      "versionStartIncluding": "4.20",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Remove rcu locks from user resources\n\nUser resource lookups used rcu to avoid two extra atomics. Unfortunately\nthe rcu paths were buggy and it was easy to make the driver crash by\nsubmitting command buffers from two different threads. Because the\nlookups never show up in performance profiles replace them with a\nregular spin lock which fixes the races in accesses to those shared\nresources.\n\nFixes kernel oops\u0027es in IGT\u0027s vmwgfx execution_buffer stress test and\nseen crashes with apps using shared resources."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - Reachable only via local DRM ioctls (DRM_IOCTL_VMW_EXECBUF and related resource create/destroy) on the vmwgfx render node (/dev/dri/renderD*), not via network or adjacent protocols.\nAC:L - The attacker controls both sides of the race by submitting command buffers from multiple threads and/or destroying shared user resources concurrently; the commit notes it was easy to trigger, with no conditions outside attacker control.\nPR:L - VMW_EXECBUF and resource ioctls are DRM_RENDER_ALLOW on a DRIVER_RENDER device, so any unprivileged local user who can open the render node can exercise the path without real root or init-namespace capabilities.\nUI:N - Exploitation uses only the attacker\u2019s own ioctls on the DRM fd; no victim action such as mounting, opening a crafted file, or interacting with the attacker is required.\nS:U - Impact is use-after-free / memory corruption inside the guest kernel\u2019s vmwgfx driver under the same OS security authority; this is not a VMware guest-to-host escape or other cross-boundary breakout.\nC:H - Buggy RCU noref lookups return TTM/user-resource pointers without taking a reference while a concurrent unref can tear down and free associated objects, yielding a heap UAF that can be leveraged for arbitrary kernel reads.\nI:H - The same UAF of shared DRM/TTM resource objects enables heap spray/reuse and control-flow hijacking primitives, consistent with treating exploitable use-after-free as High integrity impact.\nA:H - The race reliably produces kernel oopses (IGT vmwgfx execution_buffer stress test and apps using shared resources), which is full availability impact."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:52:48.345Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/7ac9578e45b20e3f3c0c8eb71f5417a499a7226a"
            },
            {
              "url": "https://git.kernel.org/stable/c/a309c7194e8a2f8bd4539b9449917913f6c2cd50"
            }
          ],
          "title": "drm/vmwgfx: Remove rcu locks from user resources",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2022-48887",
        "datePublished": "2024-08-21T06:10:19.073Z",
        "dateReserved": "2024-08-21T06:06:23.290Z",
        "dateUpdated": "2026-08-05T08:52:48.345Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.