{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-49935","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-05-01T14:05:17.255Z","datePublished":"2025-06-18T10:54:36.963Z","dateUpdated":"2026-08-05T08:56:47.132Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T08:56:47.132Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndma-buf/dma-resv: check if the new fence is really later\n\nPreviously when we added a fence to a dma_resv object we always\nassumed the the newer than all the existing fences.\n\nWith Jason's work to add an UAPI to explicit export/import that's not\nnecessary the case any more. So without this check we would allow\nuserspace to force the kernel into an use after free error.\n\nSince the change is very small and defensive it's probably a good\nidea to backport this to stable kernels as well just in case others\nare using the dma_resv object in the same way."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is triggered via DMA_BUF_IOCTL_IMPORT_SYNC_FILE on a local dma-buf file descriptor (ioctl path in dma_buf_import_sync_file → dma_resv_add_fence), not via network packet processing.\nAC:L - An attacker fully controls the fence timeline by exporting an older sync_file, submitting newer GPU work, then re-importing the older fence; no conditions outside attacker control are required.\nPR:L - Any unprivileged local user who can obtain a dma-buf fd (DRM render node, Android graphics client, dma-heap) can call the import ioctl with no capability checks on the path.\nUI:N - Exploitation uses the attacker's own dma-buf and sync_file fds; no action by another user is required.\nS:U - This is a standard in-kernel use-after-free within the host kernel's authority (dma-buf/GPU memory management), not a VM escape or IOMMU boundary crossing.\nC:H - The commit states userspace can force a use-after-free; UAF of buffer backing pages enables arbitrary kernel memory disclosure.\nI:H - Premature reclaim while GPU DMA continues yields a classic heap UAF primitive usable for arbitrary writes and control-flow hijacking.\nA:H - The same UAF/synchronization failure can crash or hang the kernel (oops/panic) even when not fully exploited for code execution."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/dma-buf/dma-resv.c"],"versions":[{"version":"27836b641c1bf693c96c627388497b4e0f57441b","lessThan":"c4c798fe98adceb642050819cb57cbc8f5c27870","status":"affected","versionType":"git"},{"version":"27836b641c1bf693c96c627388497b4e0f57441b","lessThan":"a3f7c10a269d5b77dd5822ade822643ced3057f0","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/dma-buf/dma-resv.c"],"versions":[{"version":"5.0","status":"affected"},{"version":"0","lessThan":"5.0","status":"unaffected","versionType":"semver"},{"version":"5.19.8","lessThanOrEqual":"5.19.*","status":"unaffected","versionType":"semver"},{"version":"6.0","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"5.19.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0","versionEndExcluding":"6.0"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/c4c798fe98adceb642050819cb57cbc8f5c27870"},{"url":"https://git.kernel.org/stable/c/a3f7c10a269d5b77dd5822ade822643ced3057f0"}],"title":"dma-buf/dma-resv: check if the new fence is really later","x_generator":{"engine":"bippy-1.2.0"}}}}