{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-49939","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-05-01T14:05:17.255Z","datePublished":"2025-06-18T10:54:40.100Z","dateUpdated":"2026-05-11T19:09:37.124Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-05-11T19:09:37.124Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix UAF of ref->proc caused by race condition\n\nA transaction of type BINDER_TYPE_WEAK_HANDLE can fail to increment the\nreference for a node. In this case, the target proc normally releases\nthe failed reference upon close as expected. However, if the target is\ndying in parallel the call will race with binder_deferred_release(), so\nthe target could have released all of its references by now leaving the\ncleanup of the new failed reference unhandled.\n\nThe transaction then ends and the target proc gets released making the\nref->proc now a dangling pointer. Later on, ref->node is closed and we\nattempt to take spin_lock(&ref->proc->inner_lock), which leads to the\nuse-after-free bug reported below. Let's fix this by cleaning up the\nfailed reference on the spot instead of relying on the target to do so.\n\n  ==================================================================\n  BUG: KASAN: use-after-free in _raw_spin_lock+0xa8/0x150\n  Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590\n\n  CPU: 1 PID: 590 Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10\n  Hardware name: linux,dummy-virt (DT)\n  Workqueue: events binder_deferred_func\n  Call trace:\n   dump_backtrace.part.0+0x1d0/0x1e0\n   show_stack+0x18/0x70\n   dump_stack_lvl+0x68/0x84\n   print_report+0x2e4/0x61c\n   kasan_report+0xa4/0x110\n   kasan_check_range+0xfc/0x1a4\n   __kasan_check_write+0x3c/0x50\n   _raw_spin_lock+0xa8/0x150\n   binder_deferred_func+0x5e0/0x9b0\n   process_one_work+0x38c/0x5f0\n   worker_thread+0x9c/0x694\n   kthread+0x188/0x190\n   ret_from_fork+0x10/0x20"}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/android/binder.c"],"versions":[{"version":"372e3147df7016ebeaa372939e8774a1292db558","lessThan":"229f47603dd306bc0eb1a831439adb8e48bb0eae","status":"affected","versionType":"git"},{"version":"372e3147df7016ebeaa372939e8774a1292db558","lessThan":"06e5b43ca4dab06a92bf4c2f33766e6fb11b880a","status":"affected","versionType":"git"},{"version":"372e3147df7016ebeaa372939e8774a1292db558","lessThan":"30d0901b307f27d36b2655fb3048cf31ee0e89c0","status":"affected","versionType":"git"},{"version":"372e3147df7016ebeaa372939e8774a1292db558","lessThan":"9629f2dfdb1dad294b468038ff8e161e94d0b609","status":"affected","versionType":"git"},{"version":"372e3147df7016ebeaa372939e8774a1292db558","lessThan":"c2a4b5dc8fa71af73bab704d0cac42ac39767ed6","status":"affected","versionType":"git"},{"version":"372e3147df7016ebeaa372939e8774a1292db558","lessThan":"603a47f2ae56bf68288784d3c0a8c5b8e0a827ed","status":"affected","versionType":"git"},{"version":"372e3147df7016ebeaa372939e8774a1292db558","lessThan":"a0e44c64b6061dda7e00b7c458e4523e2331b739","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/android/binder.c"],"versions":[{"version":"4.14","status":"affected"},{"version":"0","lessThan":"4.14","status":"unaffected","versionType":"semver"},{"version":"4.14.293","lessThanOrEqual":"4.14.*","status":"unaffected","versionType":"semver"},{"version":"4.19.258","lessThanOrEqual":"4.19.*","status":"unaffected","versionType":"semver"},{"version":"5.4.213","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.142","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.66","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"5.19.8","lessThanOrEqual":"5.19.*","status":"unaffected","versionType":"semver"},{"version":"6.0","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"4.14.293"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"4.19.258"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"5.4.213"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"5.10.142"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"5.15.66"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"5.19.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14","versionEndExcluding":"6.0"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/229f47603dd306bc0eb1a831439adb8e48bb0eae"},{"url":"https://git.kernel.org/stable/c/06e5b43ca4dab06a92bf4c2f33766e6fb11b880a"},{"url":"https://git.kernel.org/stable/c/30d0901b307f27d36b2655fb3048cf31ee0e89c0"},{"url":"https://git.kernel.org/stable/c/9629f2dfdb1dad294b468038ff8e161e94d0b609"},{"url":"https://git.kernel.org/stable/c/c2a4b5dc8fa71af73bab704d0cac42ac39767ed6"},{"url":"https://git.kernel.org/stable/c/603a47f2ae56bf68288784d3c0a8c5b8e0a827ed"},{"url":"https://git.kernel.org/stable/c/a0e44c64b6061dda7e00b7c458e4523e2331b739"}],"title":"binder: fix UAF of ref->proc caused by race condition","x_generator":{"engine":"bippy-1.2.0"}}}}