GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-48872 (GCVE-0-2022-48872)

Vulnerability from cvelistv5 – Published: 2024-08-21 06:10 – Updated: 2026-08-05 08:52
VLAI
Title
misc: fastrpc: Fix use-after-free race condition for maps
Summary
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix use-after-free race condition for maps It is possible that in between calling fastrpc_map_get() until map->fl->lock is taken in fastrpc_free_map(), another thread can call fastrpc_map_lookup() and get a reference to a map that is about to be deleted. Rewrite fastrpc_map_get() to only increase the reference count of a map if it's non-zero. Propagate this to callers so they can know if a map is about to be deleted. Fixes this warning: refcount_t: addition on 0; use-after-free. WARNING: CPU: 5 PID: 10100 at lib/refcount.c:25 refcount_warn_saturate ... Call trace: refcount_warn_saturate [fastrpc_map_get inlined] [fastrpc_map_lookup inlined] fastrpc_map_create fastrpc_internal_invoke fastrpc_device_ioctl __arm64_sys_ioctl invoke_syscall
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:05 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c68cfb718c8f97b7f7a50ed66be5feb42d0c8988 , < 556dfdb226ce1e5231d8836159b23f8bb0395bf4 (git)
Affected: c68cfb718c8f97b7f7a50ed66be5feb42d0c8988 , < b171d0d2cf1b8387c72c8d325c5d5746fa271e39 (git)
Affected: c68cfb718c8f97b7f7a50ed66be5feb42d0c8988 , < 61a0890cb95afec5c8a2f4a879de2b6220984ef1 (git)
Affected: c68cfb718c8f97b7f7a50ed66be5feb42d0c8988 , < 079c78c68714f7d8d58e66c477b0243b31806907 (git)
Affected: c68cfb718c8f97b7f7a50ed66be5feb42d0c8988 , < 96b328d119eca7563c1edcc4e1039a62e6370ecb (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.1
Unaffected: 0 , < 5.1 (semver)
Unaffected: 5.4.230 , ≤ 5.4.* (semver)
Unaffected: 5.10.165 , ≤ 5.10.* (semver)
Unaffected: 5.15.90 , ≤ 5.15.* (semver)
Unaffected: 6.1.8 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48872",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:05:25.671974Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:32:54.076Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/misc/fastrpc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "556dfdb226ce1e5231d8836159b23f8bb0395bf4",
              "status": "affected",
              "version": "c68cfb718c8f97b7f7a50ed66be5feb42d0c8988",
              "versionType": "git"
            },
            {
              "lessThan": "b171d0d2cf1b8387c72c8d325c5d5746fa271e39",
              "status": "affected",
              "version": "c68cfb718c8f97b7f7a50ed66be5feb42d0c8988",
              "versionType": "git"
            },
            {
              "lessThan": "61a0890cb95afec5c8a2f4a879de2b6220984ef1",
              "status": "affected",
              "version": "c68cfb718c8f97b7f7a50ed66be5feb42d0c8988",
              "versionType": "git"
            },
            {
              "lessThan": "079c78c68714f7d8d58e66c477b0243b31806907",
              "status": "affected",
              "version": "c68cfb718c8f97b7f7a50ed66be5feb42d0c8988",
              "versionType": "git"
            },
            {
              "lessThan": "96b328d119eca7563c1edcc4e1039a62e6370ecb",
              "status": "affected",
              "version": "c68cfb718c8f97b7f7a50ed66be5feb42d0c8988",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/misc/fastrpc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.230",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.230",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.165",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.90",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.8",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: Fix use-after-free race condition for maps\n\nIt is possible that in between calling fastrpc_map_get() until\nmap-\u003efl-\u003elock is taken in fastrpc_free_map(), another thread can call\nfastrpc_map_lookup() and get a reference to a map that is about to be\ndeleted.\n\nRewrite fastrpc_map_get() to only increase the reference count of a map\nif it\u0027s non-zero. Propagate this to callers so they can know if a map is\nabout to be deleted.\n\nFixes this warning:\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 5 PID: 10100 at lib/refcount.c:25 refcount_warn_saturate\n...\nCall trace:\n refcount_warn_saturate\n [fastrpc_map_get inlined]\n [fastrpc_map_lookup inlined]\n fastrpc_map_create\n fastrpc_internal_invoke\n fastrpc_device_ioctl\n __arm64_sys_ioctl\n invoke_syscall"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reachable only via local ioctl on /dev/fastrpc-* (fastrpc_device_ioctl \u2192 fastrpc_internal_invoke \u2192 fastrpc_map_create/lookup); not exposed over the network.\nAC:L - The attacker fully controls both racing threads through concurrent FASTRPC_IOCTL_INVOKE (and related) ioctls on a shared fd; fl-\u003emutex never serializes these paths, and the DMA unmap/detach work in fastrpc_free_map widens the window, so the race is reliably attacker-driven.\nPR:L - fastrpc_device_open and the invoke path require no capabilities; Android/Qualcomm deployments (and prior fastrpc CVEs such as CVE-2021-28375) treat the non-secure fastrpc device as reachable by unprivileged local apps.\nUI:N - Exploitation needs no victim action beyond the attacker opening the device and issuing ioctls.\nS:U - Impact is confined to the host kernel authority (local privilege escalation / memory corruption); it does not cross a VM, IOMMU, or other security boundary.\nC:H - Use-after-free of struct fastrpc_map (dma_buf, sg_table, phys/va, list linkage) enables heap reuse and arbitrary kernel read primitives.\nI:H - The same UAF on map metadata and list/dma structures is exploitable for arbitrary kernel writes and control-flow hijacking.\nA:H - The UAF triggers refcount warnings and kernel oops/panic even when not fully exploited, so availability impact is high."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:52:43.003Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/556dfdb226ce1e5231d8836159b23f8bb0395bf4"
        },
        {
          "url": "https://git.kernel.org/stable/c/b171d0d2cf1b8387c72c8d325c5d5746fa271e39"
        },
        {
          "url": "https://git.kernel.org/stable/c/61a0890cb95afec5c8a2f4a879de2b6220984ef1"
        },
        {
          "url": "https://git.kernel.org/stable/c/079c78c68714f7d8d58e66c477b0243b31806907"
        },
        {
          "url": "https://git.kernel.org/stable/c/96b328d119eca7563c1edcc4e1039a62e6370ecb"
        }
      ],
      "title": "misc: fastrpc: Fix use-after-free race condition for maps",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48872",
    "datePublished": "2024-08-21T06:10:02.954Z",
    "dateReserved": "2024-07-16T11:38:08.921Z",
    "dateUpdated": "2026-08-05T08:52:43.003Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48872",
      "date": "2026-09-16",
      "epss": "0.00244",
      "percentile": "0.15811"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.1\", \"versionEndExcluding\": \"5.4.230\", \"matchCriteriaId\": \"D5DAF18C-BC5F-4D9D-A710-21074AD7750B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.5\", \"versionEndExcluding\": \"5.10.165\", \"matchCriteriaId\": \"C6002D5B-9B6A-4788-B943-E3EE01E01303\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.90\", \"matchCriteriaId\": \"E995CDA5-7223-4FDB-BAD3-81B22C763A43\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.2\", \"matchCriteriaId\": \"CDB2EE10-7AC0-4F90-BC35-A5139EEE551B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"FF501633-2F44-4913-A8EE-B021929F49F6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"2BDA597B-CAC1-4DF0-86F0-42E142C654E9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"725C78C9-12CE-406F-ABE8-0813A01D66E8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"A127C155-689C-4F67-B146-44A57F4BFD85\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmisc: fastrpc: Fix use-after-free race condition for maps\\n\\nIt is possible that in between calling fastrpc_map_get() until\\nmap-\u003efl-\u003elock is taken in fastrpc_free_map(), another thread can call\\nfastrpc_map_lookup() and get a reference to a map that is about to be\\ndeleted.\\n\\nRewrite fastrpc_map_get() to only increase the reference count of a map\\nif it\u0027s non-zero. Propagate this to callers so they can know if a map is\\nabout to be deleted.\\n\\nFixes this warning:\\nrefcount_t: addition on 0; use-after-free.\\nWARNING: CPU: 5 PID: 10100 at lib/refcount.c:25 refcount_warn_saturate\\n...\\nCall trace:\\n refcount_warn_saturate\\n [fastrpc_map_get inlined]\\n [fastrpc_map_lookup inlined]\\n fastrpc_map_create\\n fastrpc_internal_invoke\\n fastrpc_device_ioctl\\n __arm64_sys_ioctl\\n invoke_syscall\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: misc: fastrpc: corrige la condici\\u00f3n de ejecuci\\u00f3n de use-after-free para mapas. Es posible que entre llamadas a fastrpc_map_get() hasta que se tome map-\u0026gt;fl-\u0026gt;lock en fastrpc_free_map() , otro hilo puede llamar a fastrpc_map_lookup() y obtener una referencia a un mapa que est\\u00e1 a punto de ser eliminado. Vuelva a escribir fastrpc_map_get() para aumentar solo el recuento de referencias de un mapa si no es cero. Propague esto a las personas que llaman para que puedan saber si un mapa est\\u00e1 a punto de ser eliminado. Corrige esta advertencia: refcount_t: adici\\u00f3n en 0; use-after-free. ADVERTENCIA: CPU: 5 PID: 10100 en lib/refcount.c:25 refcount_warn_saturate... Rastreo de llamadas: refcount_warn_saturate [fastrpc_map_get inlined] [fastrpc_map_lookup inlined] fastrpc_map_create fastrpc_internal_invoke fastrpc_device_ioctl __arm64_sys_ioctl invoke_sy llamar\"}]",
      "id": "CVE-2022-48872",
      "lastModified": "2024-09-06T14:30:06.730",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.0, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.0, \"impactScore\": 5.9}]}",
      "published": "2024-08-21T07:15:04.267",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/079c78c68714f7d8d58e66c477b0243b31806907\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/556dfdb226ce1e5231d8836159b23f8bb0395bf4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/61a0890cb95afec5c8a2f4a879de2b6220984ef1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/96b328d119eca7563c1edcc4e1039a62e6370ecb\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b171d0d2cf1b8387c72c8d325c5d5746fa271e39\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48872\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-21T07:15:04.267\",\"lastModified\":\"2026-08-04T10:17:24.790\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmisc: fastrpc: Fix use-after-free race condition for maps\\n\\nIt is possible that in between calling fastrpc_map_get() until\\nmap-\u003efl-\u003elock is taken in fastrpc_free_map(), another thread can call\\nfastrpc_map_lookup() and get a reference to a map that is about to be\\ndeleted.\\n\\nRewrite fastrpc_map_get() to only increase the reference count of a map\\nif it\u0027s non-zero. Propagate this to callers so they can know if a map is\\nabout to be deleted.\\n\\nFixes this warning:\\nrefcount_t: addition on 0; use-after-free.\\nWARNING: CPU: 5 PID: 10100 at lib/refcount.c:25 refcount_warn_saturate\\n...\\nCall trace:\\n refcount_warn_saturate\\n [fastrpc_map_get inlined]\\n [fastrpc_map_lookup inlined]\\n fastrpc_map_create\\n fastrpc_internal_invoke\\n fastrpc_device_ioctl\\n __arm64_sys_ioctl\\n invoke_syscall\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: misc: fastrpc: corrige la condici\u00f3n de ejecuci\u00f3n de use-after-free para mapas. Es posible que entre llamadas a fastrpc_map_get() hasta que se tome map-\u0026gt;fl-\u0026gt;lock en fastrpc_free_map() , otro hilo puede llamar a fastrpc_map_lookup() y obtener una referencia a un mapa que est\u00e1 a punto de ser eliminado. Vuelva a escribir fastrpc_map_get() para aumentar solo el recuento de referencias de un mapa si no es cero. Propague esto a las personas que llaman para que puedan saber si un mapa est\u00e1 a punto de ser eliminado. Corrige esta advertencia: refcount_t: adici\u00f3n en 0; use-after-free. ADVERTENCIA: CPU: 5 PID: 10100 en lib/refcount.c:25 refcount_warn_saturate... Rastreo de llamadas: refcount_warn_saturate [fastrpc_map_get inlined] [fastrpc_map_lookup inlined] fastrpc_map_create fastrpc_internal_invoke fastrpc_device_ioctl __arm64_sys_ioctl invoke_sy llamar\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/misc/fastrpc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c68cfb718c8f97b7f7a50ed66be5feb42d0c8988\",\"lessThan\":\"556dfdb226ce1e5231d8836159b23f8bb0395bf4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c68cfb718c8f97b7f7a50ed66be5feb42d0c8988\",\"lessThan\":\"b171d0d2cf1b8387c72c8d325c5d5746fa271e39\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c68cfb718c8f97b7f7a50ed66be5feb42d0c8988\",\"lessThan\":\"61a0890cb95afec5c8a2f4a879de2b6220984ef1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c68cfb718c8f97b7f7a50ed66be5feb42d0c8988\",\"lessThan\":\"079c78c68714f7d8d58e66c477b0243b31806907\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c68cfb718c8f97b7f7a50ed66be5feb42d0c8988\",\"lessThan\":\"96b328d119eca7563c1edcc4e1039a62e6370ecb\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/misc/fastrpc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.230\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.165\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.90\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.8\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:05:25.671974Z\",\"id\":\"CVE-2022-48872\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.1\",\"versionEndExcluding\":\"5.4.230\",\"matchCriteriaId\":\"D5DAF18C-BC5F-4D9D-A710-21074AD7750B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.165\",\"matchCriteriaId\":\"C6002D5B-9B6A-4788-B943-E3EE01E01303\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.90\",\"matchCriteriaId\":\"E995CDA5-7223-4FDB-BAD3-81B22C763A43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.2\",\"matchCriteriaId\":\"CDB2EE10-7AC0-4F90-BC35-A5139EEE551B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF501633-2F44-4913-A8EE-B021929F49F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BDA597B-CAC1-4DF0-86F0-42E142C654E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"725C78C9-12CE-406F-ABE8-0813A01D66E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A127C155-689C-4F67-B146-44A57F4BFD85\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/079c78c68714f7d8d58e66c477b0243b31806907\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/556dfdb226ce1e5231d8836159b23f8bb0395bf4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/61a0890cb95afec5c8a2f4a879de2b6220984ef1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/96b328d119eca7563c1edcc4e1039a62e6370ecb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b171d0d2cf1b8387c72c8d325c5d5746fa271e39\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:47:52+00:00",
      "cve": "CVE-2022-48872",
      "id": "CVE-2022-48872",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: misc: fastrpc: Fix use-after-free race condition for maps",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-48872.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-11T02:33:14Z",
      "cve": "CVE-2022-48872",
      "id": "CVE-2022-48872",
      "initial_release_date": "2024-08-22T03:29:37Z",
      "product_status:known_affected": "310",
      "product_status:known_not_affected": "185",
      "product_status:recommended": "540",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-48872",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-48872.json",
      "version": "57"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48872\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:05:25.671974Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:11.924Z\"}}], \"cna\": {\"title\": \"misc: fastrpc: Fix use-after-free race condition for maps\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Reachable only via local ioctl on /dev/fastrpc-* (fastrpc_device_ioctl \\u2192 fastrpc_internal_invoke \\u2192 fastrpc_map_create/lookup); not exposed over the network.\\nAC:L - The attacker fully controls both racing threads through concurrent FASTRPC_IOCTL_INVOKE (and related) ioctls on a shared fd; fl-\u003emutex never serializes these paths, and the DMA unmap/detach work in fastrpc_free_map widens the window, so the race is reliably attacker-driven.\\nPR:L - fastrpc_device_open and the invoke path require no capabilities; Android/Qualcomm deployments (and prior fastrpc CVEs such as CVE-2021-28375) treat the non-secure fastrpc device as reachable by unprivileged local apps.\\nUI:N - Exploitation needs no victim action beyond the attacker opening the device and issuing ioctls.\\nS:U - Impact is confined to the host kernel authority (local privilege escalation / memory corruption); it does not cross a VM, IOMMU, or other security boundary.\\nC:H - Use-after-free of struct fastrpc_map (dma_buf, sg_table, phys/va, list linkage) enables heap reuse and arbitrary kernel read primitives.\\nI:H - The same UAF on map metadata and list/dma structures is exploitable for arbitrary kernel writes and control-flow hijacking.\\nA:H - The UAF triggers refcount warnings and kernel oops/panic even when not fully exploited, so availability impact is high.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c68cfb718c8f97b7f7a50ed66be5feb42d0c8988\", \"lessThan\": \"556dfdb226ce1e5231d8836159b23f8bb0395bf4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c68cfb718c8f97b7f7a50ed66be5feb42d0c8988\", \"lessThan\": \"b171d0d2cf1b8387c72c8d325c5d5746fa271e39\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c68cfb718c8f97b7f7a50ed66be5feb42d0c8988\", \"lessThan\": \"61a0890cb95afec5c8a2f4a879de2b6220984ef1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c68cfb718c8f97b7f7a50ed66be5feb42d0c8988\", \"lessThan\": \"079c78c68714f7d8d58e66c477b0243b31806907\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c68cfb718c8f97b7f7a50ed66be5feb42d0c8988\", \"lessThan\": \"96b328d119eca7563c1edcc4e1039a62e6370ecb\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/misc/fastrpc.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.1\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.1\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.230\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.165\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.90\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.2\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/misc/fastrpc.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/556dfdb226ce1e5231d8836159b23f8bb0395bf4\"}, {\"url\": \"https://git.kernel.org/stable/c/b171d0d2cf1b8387c72c8d325c5d5746fa271e39\"}, {\"url\": \"https://git.kernel.org/stable/c/61a0890cb95afec5c8a2f4a879de2b6220984ef1\"}, {\"url\": \"https://git.kernel.org/stable/c/079c78c68714f7d8d58e66c477b0243b31806907\"}, {\"url\": \"https://git.kernel.org/stable/c/96b328d119eca7563c1edcc4e1039a62e6370ecb\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmisc: fastrpc: Fix use-after-free race condition for maps\\n\\nIt is possible that in between calling fastrpc_map_get() until\\nmap-\u003efl-\u003elock is taken in fastrpc_free_map(), another thread can call\\nfastrpc_map_lookup() and get a reference to a map that is about to be\\ndeleted.\\n\\nRewrite fastrpc_map_get() to only increase the reference count of a map\\nif it\u0027s non-zero. Propagate this to callers so they can know if a map is\\nabout to be deleted.\\n\\nFixes this warning:\\nrefcount_t: addition on 0; use-after-free.\\nWARNING: CPU: 5 PID: 10100 at lib/refcount.c:25 refcount_warn_saturate\\n...\\nCall trace:\\n refcount_warn_saturate\\n [fastrpc_map_get inlined]\\n [fastrpc_map_lookup inlined]\\n fastrpc_map_create\\n fastrpc_internal_invoke\\n fastrpc_device_ioctl\\n __arm64_sys_ioctl\\n invoke_syscall\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.230\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.165\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.90\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.8\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.2\", \"versionStartIncluding\": \"5.1\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:52:43.003Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48872\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:52:43.003Z\", \"dateReserved\": \"2024-07-16T11:38:08.921Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-21T06:10:02.954Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.