CVE-2022-48950 (GCVE-0-2022-48950)

Vulnerability from cvelistv5 – Published: 2024-10-21 20:05 – Updated: 2026-08-05 08:53
VLAI
Title
perf: Fix perf_pending_task() UaF
Summary
In the Linux kernel, the following vulnerability has been resolved: perf: Fix perf_pending_task() UaF Per syzbot it is possible for perf_pending_task() to run after the event is free()'d. There are two related but distinct cases: - the task_work was already queued before destroying the event; - destroying the event itself queues the task_work. The first cannot be solved using task_work_cancel() since perf_release() itself might be called from a task_work (____fput), which means the current->task_works list is already empty and task_work_cancel() won't be able to find the perf_pending_task() entry. The simplest alternative is extending the perf_event lifetime to cover the task_work. The second is just silly, queueing a task_work while you know the event is going away makes no sense and is easily avoided by re-arranging how the event is marked STATE_DEAD and ensuring it goes through STATE_OFF on the way down.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-22 13:21 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ca7b0a10287e2733bdafb01ef0d4038536625fe3 , < 8bffa95ac19ff27c8261904f89d36c7fcf215d59 (git)
Affected: 078c12ccf1fb943cc18c84894c76113dc89e5975 , < 78e1317a174edbfd1182599bf76c092a2877672c (git)
Affected: ca6c21327c6af02b7eec31ce4b9a740a18c6c13f , < 517e6a301f34613bff24a8e35b5455884f2d83d8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15.77 , < 5.15.84 (semver)
Affected: 6.0.7 , < 6.0.14 (semver)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48950",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:21:45.788376Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:28:40.788Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8bffa95ac19ff27c8261904f89d36c7fcf215d59",
              "status": "affected",
              "version": "ca7b0a10287e2733bdafb01ef0d4038536625fe3",
              "versionType": "git"
            },
            {
              "lessThan": "78e1317a174edbfd1182599bf76c092a2877672c",
              "status": "affected",
              "version": "078c12ccf1fb943cc18c84894c76113dc89e5975",
              "versionType": "git"
            },
            {
              "lessThan": "517e6a301f34613bff24a8e35b5455884f2d83d8",
              "status": "affected",
              "version": "ca6c21327c6af02b7eec31ce4b9a740a18c6c13f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5.15.84",
              "status": "affected",
              "version": "5.15.77",
              "versionType": "semver"
            },
            {
              "lessThan": "6.0.14",
              "status": "affected",
              "version": "6.0.7",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.84",
                  "versionStartIncluding": "5.15.77",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.14",
                  "versionStartIncluding": "6.0.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix perf_pending_task() UaF\n\nPer syzbot it is possible for perf_pending_task() to run after the\nevent is free()\u0027d. There are two related but distinct cases:\n\n - the task_work was already queued before destroying the event;\n - destroying the event itself queues the task_work.\n\nThe first cannot be solved using task_work_cancel() since\nperf_release() itself might be called from a task_work (____fput),\nwhich means the current-\u003etask_works list is already empty and\ntask_work_cancel() won\u0027t be able to find the perf_pending_task()\nentry.\n\nThe simplest alternative is extending the perf_event lifetime to cover\nthe task_work.\n\nThe second is just silly, queueing a task_work while you know the\nevent is going away makes no sense and is easily avoided by\nre-arranging how the event is marked STATE_DEAD and ensuring it goes\nthrough STATE_OFF on the way down."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached via the local perf_event_open(2) syscall and subsequent event close/release; it is not reachable from the network stack or remote protocols.\nAC:L - An attacker fully controls event creation, overflow/sigtrap triggering, and close/destroy; destroying an event with pending_sigtrap itself queues perf_pending_task then frees the object, so the UAF does not depend on conditions outside attacker influence.\nPR:L - Unprivileged users can open sampling events with attr.sigtrap on their own tasks because ptrace_may_access succeeds for same_thread_group self-access, and default perf_event_paranoid still allows self-monitoring with exclude_kernel.\nUI:N - Exploitation requires only the attacker\u0027s own syscalls (perf_event_open, activity to overflow, close/exit); no victim user action is needed.\nS:U - Impact is confined to the local kernel privilege boundary (standard local privilege escalation); this is not a VM escape, IOMMU bypass, or other cross-authority boundary.\nC:H - This is a use-after-free of a large perf_event slab object (~1.4KB); after free, perf_pending_task/perf_sigtrap dereference attacker-sprayable memory, enabling arbitrary kernel read primitives.\nI:H - The same UAF provides a write/control-flow hijack surface via heap reuse of the freed perf_event (including callback_head and ctx pointer use), enabling arbitrary kernel write and code execution.\nA:H - The UAF reliably causes kernel oops/panic (demonstrated by syzbot KASAN crashes in task_work_run/perf_pending_task), fully impacting system availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:53:05.541Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8bffa95ac19ff27c8261904f89d36c7fcf215d59"
        },
        {
          "url": "https://git.kernel.org/stable/c/78e1317a174edbfd1182599bf76c092a2877672c"
        },
        {
          "url": "https://git.kernel.org/stable/c/517e6a301f34613bff24a8e35b5455884f2d83d8"
        }
      ],
      "title": "perf: Fix perf_pending_task() UaF",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48950",
    "datePublished": "2024-10-21T20:05:38.440Z",
    "dateReserved": "2024-08-22T01:27:53.625Z",
    "dateUpdated": "2026-08-05T08:53:05.541Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48950",
      "date": "2026-09-24",
      "epss": "0.00252",
      "percentile": "0.1478"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "8F012D68-F8BC-4FEE-9203-10B77967371C",
                  "versionEndExcluding": "5.15.84",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "8761B6C5-F658-46D1-92B8-4ED28F931D6A",
                  "versionEndExcluding": "6.0.14",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*",
                  "matchCriteriaId": "E7E331DA-1FB0-4DEC-91AC-7DA69D461C11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*",
                  "matchCriteriaId": "17F0B248-42CF-4AE6-A469-BB1BAE7F4705",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*",
                  "matchCriteriaId": "E2422816-0C14-4B5E-A1E6-A9D776E5C49B",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*",
                  "matchCriteriaId": "1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*",
                  "matchCriteriaId": "35B26BE4-43A6-4A36-A7F6-5B3F572D9186",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*",
                  "matchCriteriaId": "3FFFB0B3-930D-408A-91E2-BAE0C2715D80",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*",
                  "matchCriteriaId": "8535320E-A0DB-4277-800E-D0CE5BBA59E8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:*",
                  "matchCriteriaId": "21718AA4-4056-40F2-968E-BDAA465A7872",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix perf_pending_task() UaF\n\nPer syzbot it is possible for perf_pending_task() to run after the\nevent is free()\u0027d. There are two related but distinct cases:\n\n - the task_work was already queued before destroying the event;\n - destroying the event itself queues the task_work.\n\nThe first cannot be solved using task_work_cancel() since\nperf_release() itself might be called from a task_work (____fput),\nwhich means the current-\u003etask_works list is already empty and\ntask_work_cancel() won\u0027t be able to find the perf_pending_task()\nentry.\n\nThe simplest alternative is extending the perf_event lifetime to cover\nthe task_work.\n\nThe second is just silly, queueing a task_work while you know the\nevent is going away makes no sense and is easily avoided by\nre-arranging how the event is marked STATE_DEAD and ensuring it goes\nthrough STATE_OFF on the way down."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: perf: Fix perf_pending_task() UaF Por syzbot es posible que perf_pending_task() se ejecute despu\u00e9s de que el evento sea free(). Hay dos casos relacionados pero distintos: - el task_work ya estaba en cola antes de destruir el evento; - destruir el evento en s\u00ed mismo pone en cola el task_work. El primero no se puede resolver usando task_work_cancel() ya que perf_release() en s\u00ed mismo podr\u00eda ser llamado desde un task_work (____fput), lo que significa que la lista current-\u0026gt;task_works ya est\u00e1 vac\u00eda y task_work_cancel() no podr\u00e1 encontrar la entrada perf_pending_task(). La alternativa m\u00e1s simple es extender la duraci\u00f3n de perf_event para cubrir el task_work. El segundo es simplemente una tonter\u00eda, poner en cola una tarea_trabajo mientras sabes que el evento va a desaparecer no tiene sentido y se evita f\u00e1cilmente reorganizando c\u00f3mo se marca el evento como STATE_DEAD y asegur\u00e1ndose de que pase por STATE_OFF en el camino hacia abajo."
        }
      ],
      "id": "CVE-2022-48950",
      "lastModified": "2024-10-25T20:02:03.240",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-10-21T20:15:06.440",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/517e6a301f34613bff24a8e35b5455884f2d83d8"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/78e1317a174edbfd1182599bf76c092a2877672c"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/8bffa95ac19ff27c8261904f89d36c7fcf215d59"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-416"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/events/core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "8bffa95ac19ff27c8261904f89d36c7fcf215d59",
                    "status": "affected",
                    "version": "ca7b0a10287e2733bdafb01ef0d4038536625fe3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "78e1317a174edbfd1182599bf76c092a2877672c",
                    "status": "affected",
                    "version": "078c12ccf1fb943cc18c84894c76113dc89e5975",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "517e6a301f34613bff24a8e35b5455884f2d83d8",
                    "status": "affected",
                    "version": "ca6c21327c6af02b7eec31ce4b9a740a18c6c13f",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/events/core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5.15.84",
                    "status": "affected",
                    "version": "5.15.77",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.0.14",
                    "status": "affected",
                    "version": "6.0.7",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8F012D68-F8BC-4FEE-9203-10B77967371C",
                    "versionEndExcluding": "5.15.84",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8761B6C5-F658-46D1-92B8-4ED28F931D6A",
                    "versionEndExcluding": "6.0.14",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "E7E331DA-1FB0-4DEC-91AC-7DA69D461C11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "17F0B248-42CF-4AE6-A469-BB1BAE7F4705",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "E2422816-0C14-4B5E-A1E6-A9D776E5C49B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "35B26BE4-43A6-4A36-A7F6-5B3F572D9186",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "3FFFB0B3-930D-408A-91E2-BAE0C2715D80",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "8535320E-A0DB-4277-800E-D0CE5BBA59E8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:*",
                    "matchCriteriaId": "21718AA4-4056-40F2-968E-BDAA465A7872",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix perf_pending_task() UaF\n\nPer syzbot it is possible for perf_pending_task() to run after the\nevent is free()\u0027d. There are two related but distinct cases:\n\n - the task_work was already queued before destroying the event;\n - destroying the event itself queues the task_work.\n\nThe first cannot be solved using task_work_cancel() since\nperf_release() itself might be called from a task_work (____fput),\nwhich means the current-\u003etask_works list is already empty and\ntask_work_cancel() won\u0027t be able to find the perf_pending_task()\nentry.\n\nThe simplest alternative is extending the perf_event lifetime to cover\nthe task_work.\n\nThe second is just silly, queueing a task_work while you know the\nevent is going away makes no sense and is easily avoided by\nre-arranging how the event is marked STATE_DEAD and ensuring it goes\nthrough STATE_OFF on the way down."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: perf: Fix perf_pending_task() UaF Por syzbot es posible que perf_pending_task() se ejecute despu\u00e9s de que el evento sea free(). Hay dos casos relacionados pero distintos: - el task_work ya estaba en cola antes de destruir el evento; - destruir el evento en s\u00ed mismo pone en cola el task_work. El primero no se puede resolver usando task_work_cancel() ya que perf_release() en s\u00ed mismo podr\u00eda ser llamado desde un task_work (____fput), lo que significa que la lista current-\u0026gt;task_works ya est\u00e1 vac\u00eda y task_work_cancel() no podr\u00e1 encontrar la entrada perf_pending_task(). La alternativa m\u00e1s simple es extender la duraci\u00f3n de perf_event para cubrir el task_work. El segundo es simplemente una tonter\u00eda, poner en cola una tarea_trabajo mientras sabes que el evento va a desaparecer no tiene sentido y se evita f\u00e1cilmente reorganizando c\u00f3mo se marca el evento como STATE_DEAD y asegur\u00e1ndose de que pase por STATE_OFF en el camino hacia abajo."
          }
        ],
        "id": "CVE-2022-48950",
        "lastModified": "2026-08-04T10:17:27.983",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-48950",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:21:45.788376Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-10-21T20:15:06.440",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/517e6a301f34613bff24a8e35b5455884f2d83d8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/78e1317a174edbfd1182599bf76c092a2877672c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8bffa95ac19ff27c8261904f89d36c7fcf215d59"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T21:04:51+00:00",
      "cve": "CVE-2022-48950",
      "id": "CVE-2022-48950",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "182",
      "product_status:known_not_affected": "16",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: perf: Fix perf_pending_task() UaF",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-48950.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T01:35:51Z",
      "cve": "CVE-2022-48950",
      "id": "CVE-2022-48950",
      "initial_release_date": "2024-10-22T14:23:26Z",
      "product_status:known_not_affected": "498",
      "product_status:recommended": "29",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-48950",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-48950.json",
      "version": "20"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-48950",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-10-22T13:21:45.788376Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-10-22T13:21:48.944Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "kernel/events/core.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "8bffa95ac19ff27c8261904f89d36c7fcf215d59",
                  "status": "affected",
                  "version": "ca7b0a10287e2733bdafb01ef0d4038536625fe3",
                  "versionType": "git"
                },
                {
                  "lessThan": "78e1317a174edbfd1182599bf76c092a2877672c",
                  "status": "affected",
                  "version": "078c12ccf1fb943cc18c84894c76113dc89e5975",
                  "versionType": "git"
                },
                {
                  "lessThan": "517e6a301f34613bff24a8e35b5455884f2d83d8",
                  "status": "affected",
                  "version": "ca6c21327c6af02b7eec31ce4b9a740a18c6c13f",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "kernel/events/core.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "5.15.84",
                  "status": "affected",
                  "version": "5.15.77",
                  "versionType": "semver"
                },
                {
                  "lessThan": "6.0.14",
                  "status": "affected",
                  "version": "6.0.7",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.84",
                      "versionStartIncluding": "5.15.77",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.0.14",
                      "versionStartIncluding": "6.0.7",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix perf_pending_task() UaF\n\nPer syzbot it is possible for perf_pending_task() to run after the\nevent is free()\u0027d. There are two related but distinct cases:\n\n - the task_work was already queued before destroying the event;\n - destroying the event itself queues the task_work.\n\nThe first cannot be solved using task_work_cancel() since\nperf_release() itself might be called from a task_work (____fput),\nwhich means the current-\u003etask_works list is already empty and\ntask_work_cancel() won\u0027t be able to find the perf_pending_task()\nentry.\n\nThe simplest alternative is extending the perf_event lifetime to cover\nthe task_work.\n\nThe second is just silly, queueing a task_work while you know the\nevent is going away makes no sense and is easily avoided by\nre-arranging how the event is marked STATE_DEAD and ensuring it goes\nthrough STATE_OFF on the way down."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The vulnerable path is reached via the local perf_event_open(2) syscall and subsequent event close/release; it is not reachable from the network stack or remote protocols.\nAC:L - An attacker fully controls event creation, overflow/sigtrap triggering, and close/destroy; destroying an event with pending_sigtrap itself queues perf_pending_task then frees the object, so the UAF does not depend on conditions outside attacker influence.\nPR:L - Unprivileged users can open sampling events with attr.sigtrap on their own tasks because ptrace_may_access succeeds for same_thread_group self-access, and default perf_event_paranoid still allows self-monitoring with exclude_kernel.\nUI:N - Exploitation requires only the attacker\u0027s own syscalls (perf_event_open, activity to overflow, close/exit); no victim user action is needed.\nS:U - Impact is confined to the local kernel privilege boundary (standard local privilege escalation); this is not a VM escape, IOMMU bypass, or other cross-authority boundary.\nC:H - This is a use-after-free of a large perf_event slab object (~1.4KB); after free, perf_pending_task/perf_sigtrap dereference attacker-sprayable memory, enabling arbitrary kernel read primitives.\nI:H - The same UAF provides a write/control-flow hijack surface via heap reuse of the freed perf_event (including callback_head and ctx pointer use), enabling arbitrary kernel write and code execution.\nA:H - The UAF reliably causes kernel oops/panic (demonstrated by syzbot KASAN crashes in task_work_run/perf_pending_task), fully impacting system availability."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:53:05.541Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/8bffa95ac19ff27c8261904f89d36c7fcf215d59"
            },
            {
              "url": "https://git.kernel.org/stable/c/78e1317a174edbfd1182599bf76c092a2877672c"
            },
            {
              "url": "https://git.kernel.org/stable/c/517e6a301f34613bff24a8e35b5455884f2d83d8"
            }
          ],
          "title": "perf: Fix perf_pending_task() UaF",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2022-48950",
        "datePublished": "2024-10-21T20:05:38.440Z",
        "dateReserved": "2024-08-22T01:27:53.625Z",
        "dateUpdated": "2026-08-05T08:53:05.541Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.