CVE-2022-49935CWE-416

CVE-2022-49935

High · published June 18, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
6.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

dma-buf/dma-resv: check if the new fence is really later

Previously when we added a fence to a dma_resv object we always

assumed the the newer than all the existing fences.

With Jason's work to add an UAPI to explicit export/import that's not

necessary the case any more. So without this check we would allow

userspace to force the kernel into an use after free error.

Since the change is very small and defensive it's probably a good

idea to backport this to stable kernels as well just in case others

are using the dma_resv object in the same way.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00173 · 6.4th percentile
Weakness
CWE-416 · Use After Free
Published
2025-06-18T15:15Z
Affected products (4)
ProductVersionsFixed in
linux/linux_kernel≥ 5.0, < 5.19.85.19.8
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (2)
EPSS history
Timeline
  • 18 JUN 10:54Z
    dma-buf/dma-resv: check if the new fence is really later
    cvelistv5