CVE-2022-49554 (GCVE-0-2022-49554)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:14 – Updated: 2026-08-05 08:55
VLAI
Title
zsmalloc: fix races between asynchronous zspage free and page migration
Summary
In the Linux kernel, the following vulnerability has been resolved: zsmalloc: fix races between asynchronous zspage free and page migration The asynchronous zspage free worker tries to lock a zspage's entire page list without defending against page migration. Since pages which haven't yet been locked can concurrently migrate off the zspage page list while lock_zspage() churns away, lock_zspage() can suffer from a few different lethal races. It can lock a page which no longer belongs to the zspage and unsafely dereference page_private(), it can unsafely dereference a torn pointer to the next page (since there's a data race), and it can observe a spurious NULL pointer to the next page and thus not lock all of the zspage's pages (since a single page migration will reconstruct the entire page list, and create_page_chain() unconditionally zeroes out each list pointer in the process). Fix the races by using migrate_read_lock() in lock_zspage() to synchronize with page migration.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 77ff465799c60294e248000cd22ae8171da3304c , < 3674d8a8dadd03a447dd21069d4dacfc3399b63b (git)
Affected: 77ff465799c60294e248000cd22ae8171da3304c , < 645996efc2ae391246d595832aaa6f9d3cc338c7 (git)
Affected: 77ff465799c60294e248000cd22ae8171da3304c , < fc658c083904427abbf8f18280d517ee2668677c (git)
Affected: 77ff465799c60294e248000cd22ae8171da3304c , < fae05b2314b147a78fbed1dc4c645d9a66313758 (git)
Affected: 77ff465799c60294e248000cd22ae8171da3304c , < 3ec459c8810e658401be428d3168eacfc380bdd0 (git)
Affected: 77ff465799c60294e248000cd22ae8171da3304c , < 8ba7b7c1dad1f6503c541778f31b33f7f62eb966 (git)
Affected: 77ff465799c60294e248000cd22ae8171da3304c , < c5402fb5f71f1a725f1e55d9c6799c0c7bec308f (git)
Affected: 77ff465799c60294e248000cd22ae8171da3304c , < 2505a981114dcb715f8977b8433f7540854851d8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.14
Unaffected: 0 , < 4.14 (semver)
Unaffected: 4.14.282 , ≤ 4.14.* (semver)
Unaffected: 4.19.246 , ≤ 4.19.* (semver)
Unaffected: 5.4.197 , ≤ 5.4.* (semver)
Unaffected: 5.10.120 , ≤ 5.10.* (semver)
Unaffected: 5.15.45 , ≤ 5.15.* (semver)
Unaffected: 5.17.13 , ≤ 5.17.* (semver)
Unaffected: 5.18.2 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/zsmalloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3674d8a8dadd03a447dd21069d4dacfc3399b63b",
              "status": "affected",
              "version": "77ff465799c60294e248000cd22ae8171da3304c",
              "versionType": "git"
            },
            {
              "lessThan": "645996efc2ae391246d595832aaa6f9d3cc338c7",
              "status": "affected",
              "version": "77ff465799c60294e248000cd22ae8171da3304c",
              "versionType": "git"
            },
            {
              "lessThan": "fc658c083904427abbf8f18280d517ee2668677c",
              "status": "affected",
              "version": "77ff465799c60294e248000cd22ae8171da3304c",
              "versionType": "git"
            },
            {
              "lessThan": "fae05b2314b147a78fbed1dc4c645d9a66313758",
              "status": "affected",
              "version": "77ff465799c60294e248000cd22ae8171da3304c",
              "versionType": "git"
            },
            {
              "lessThan": "3ec459c8810e658401be428d3168eacfc380bdd0",
              "status": "affected",
              "version": "77ff465799c60294e248000cd22ae8171da3304c",
              "versionType": "git"
            },
            {
              "lessThan": "8ba7b7c1dad1f6503c541778f31b33f7f62eb966",
              "status": "affected",
              "version": "77ff465799c60294e248000cd22ae8171da3304c",
              "versionType": "git"
            },
            {
              "lessThan": "c5402fb5f71f1a725f1e55d9c6799c0c7bec308f",
              "status": "affected",
              "version": "77ff465799c60294e248000cd22ae8171da3304c",
              "versionType": "git"
            },
            {
              "lessThan": "2505a981114dcb715f8977b8433f7540854851d8",
              "status": "affected",
              "version": "77ff465799c60294e248000cd22ae8171da3304c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/zsmalloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.282",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.246",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.197",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.282",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.246",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.197",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.120",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.45",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.13",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.2",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nzsmalloc: fix races between asynchronous zspage free and page migration\n\nThe asynchronous zspage free worker tries to lock a zspage\u0027s entire page\nlist without defending against page migration.  Since pages which haven\u0027t\nyet been locked can concurrently migrate off the zspage page list while\nlock_zspage() churns away, lock_zspage() can suffer from a few different\nlethal races.\n\nIt can lock a page which no longer belongs to the zspage and unsafely\ndereference page_private(), it can unsafely dereference a torn pointer to\nthe next page (since there\u0027s a data race), and it can observe a spurious\nNULL pointer to the next page and thus not lock all of the zspage\u0027s pages\n(since a single page migration will reconstruct the entire page list, and\ncreate_page_chain() unconditionally zeroes out each list pointer in the\nprocess).\n\nFix the races by using migrate_read_lock() in lock_zspage() to synchronize\nwith page migration."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is in mm/zsmalloc.c (async_free_zspage \u2192 lock_zspage racing with zs_page_migrate), reached when an unprivileged local process drives zram/zswap alloc/free via swap or compressed-page I/O and concurrent compaction; it is not reachable from the network stack.\nAC:L - A local attacker can drive both sides of the race by allocating/freeing zsmalloc-backed swap objects (zs_free \u2192 deferred free) while inducing compaction/migration of those movable zspages, so success does not depend on conditions outside attacker influence.\nPR:L - On common deployments (e.g. Android with zram swap, or zswap with zsmalloc), any unprivileged local user can trigger zs_malloc/zs_free and memory pressure without capabilities or init-namespace root.\nUI:N - Exploitation requires no victim action beyond the system already using zsmalloc-backed zram/zswap; the attacker triggers the race solely through their own memory and I/O activity.\nS:U - Impact stays within the host kernel\u0027s authority (local memory corruption / privilege escalation); this is not a VM escape, IOMMU bypass, or other cross-boundary break.\nC:H - The race can lock the wrong page and dereference page_private(), follow a torn page-\u003eindex pointer, or free a zspage while unlocked pages remain in use\u2014UAF/memory-corruption primitives that enable arbitrary kernel reads.\nI:H - Incomplete locking of the zspage chain while migration rebuilds it via create_page_chain() allows freeing or resetting pages still under migration, yielding heap corruption exploitable for arbitrary writes and control-flow hijacking.\nA:H - The same races produce NULL/invalid pointer dereferences, use-after-free crashes, and kernel oops/panic when page_private or list links are observed inconsistently during free versus migration."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:55:40.785Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3674d8a8dadd03a447dd21069d4dacfc3399b63b"
        },
        {
          "url": "https://git.kernel.org/stable/c/645996efc2ae391246d595832aaa6f9d3cc338c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc658c083904427abbf8f18280d517ee2668677c"
        },
        {
          "url": "https://git.kernel.org/stable/c/fae05b2314b147a78fbed1dc4c645d9a66313758"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ec459c8810e658401be428d3168eacfc380bdd0"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ba7b7c1dad1f6503c541778f31b33f7f62eb966"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5402fb5f71f1a725f1e55d9c6799c0c7bec308f"
        },
        {
          "url": "https://git.kernel.org/stable/c/2505a981114dcb715f8977b8433f7540854851d8"
        }
      ],
      "title": "zsmalloc: fix races between asynchronous zspage free and page migration",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49554",
    "datePublished": "2025-02-26T02:14:02.649Z",
    "dateReserved": "2025-02-26T02:08:31.590Z",
    "dateUpdated": "2026-08-05T08:55:40.785Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49554",
      "date": "2026-08-24",
      "epss": "0.00217",
      "percentile": "0.11901"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49554\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:31.223\",\"lastModified\":\"2026-08-04T10:17:51.153\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nzsmalloc: fix races between asynchronous zspage free and page migration\\n\\nThe asynchronous zspage free worker tries to lock a zspage\u0027s entire page\\nlist without defending against page migration.  Since pages which haven\u0027t\\nyet been locked can concurrently migrate off the zspage page list while\\nlock_zspage() churns away, lock_zspage() can suffer from a few different\\nlethal races.\\n\\nIt can lock a page which no longer belongs to the zspage and unsafely\\ndereference page_private(), it can unsafely dereference a torn pointer to\\nthe next page (since there\u0027s a data race), and it can observe a spurious\\nNULL pointer to the next page and thus not lock all of the zspage\u0027s pages\\n(since a single page migration will reconstruct the entire page list, and\\ncreate_page_chain() unconditionally zeroes out each list pointer in the\\nprocess).\\n\\nFix the races by using migrate_read_lock() in lock_zspage() to synchronize\\nwith page migration.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: zsmalloc: arregla las ejecuciones entre la liberaci\u00f3n asincr\u00f3nica de zspage y la migraci\u00f3n de p\u00e1gina El trabajador de liberaci\u00f3n asincr\u00f3nica de zspage intenta bloquear la lista completa de p\u00e1ginas de una zspage sin defenderse contra la migraci\u00f3n de p\u00e1gina. Dado que las p\u00e1ginas que a\u00fan no se han bloqueado pueden migrar simult\u00e1neamente fuera de la lista de p\u00e1ginas de la zspage mientras lock_zspage() se procesa, lock_zspage() puede sufrir algunas ejecuciones letales diferentes. Puede bloquear una p\u00e1gina que ya no pertenece a la zspage y desreferenciar de forma insegura page_private(), puede desreferenciar de forma insegura un puntero roto a la siguiente p\u00e1gina (ya que hay una ejecuci\u00f3n de datos), y puede observar un puntero NULL espurio a la siguiente p\u00e1gina y, por lo tanto, no bloquear todas las p\u00e1ginas de la zspage (ya que una sola migraci\u00f3n de p\u00e1gina reconstruir\u00e1 la lista de p\u00e1ginas completa, y create_page_chain() pone a cero incondicionalmente cada puntero de lista en el proceso). Corrija las ejecuciones usando migrants_read_lock() en lock_zspage() para sincronizar con la migraci\u00f3n de p\u00e1gina.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"mm/zsmalloc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"77ff465799c60294e248000cd22ae8171da3304c\",\"lessThan\":\"3674d8a8dadd03a447dd21069d4dacfc3399b63b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"77ff465799c60294e248000cd22ae8171da3304c\",\"lessThan\":\"645996efc2ae391246d595832aaa6f9d3cc338c7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"77ff465799c60294e248000cd22ae8171da3304c\",\"lessThan\":\"fc658c083904427abbf8f18280d517ee2668677c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"77ff465799c60294e248000cd22ae8171da3304c\",\"lessThan\":\"fae05b2314b147a78fbed1dc4c645d9a66313758\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"77ff465799c60294e248000cd22ae8171da3304c\",\"lessThan\":\"3ec459c8810e658401be428d3168eacfc380bdd0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"77ff465799c60294e248000cd22ae8171da3304c\",\"lessThan\":\"8ba7b7c1dad1f6503c541778f31b33f7f62eb966\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"77ff465799c60294e248000cd22ae8171da3304c\",\"lessThan\":\"c5402fb5f71f1a725f1e55d9c6799c0c7bec308f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"77ff465799c60294e248000cd22ae8171da3304c\",\"lessThan\":\"2505a981114dcb715f8977b8433f7540854851d8\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"mm/zsmalloc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.14.282\",\"lessThanOrEqual\":\"4.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.246\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.197\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.120\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.45\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17.13\",\"lessThanOrEqual\":\"5.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18.2\",\"lessThanOrEqual\":\"5.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.14\",\"versionEndExcluding\":\"4.14.282\",\"matchCriteriaId\":\"D697ED37-2BFA-4A75-9665-BBC0B0BE0FC1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.246\",\"matchCriteriaId\":\"FEDF30DC-BB12-4C4C-A134-AA5D59D73C0C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.197\",\"matchCriteriaId\":\"F7FDD830-741D-44F7-A537-13755A4314DE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.120\",\"matchCriteriaId\":\"92818976-ECCC-4744-9287-E2CF4B2C4131\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.45\",\"matchCriteriaId\":\"08D699AD-F4CE-4BDD-A97E-4997299C7712\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.17.13\",\"matchCriteriaId\":\"192FC54B-5367-49D6-B410-0285F14665B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"5.18.2\",\"matchCriteriaId\":\"9FF255A1-64F4-4E31-AF44-C92FB8773BA2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2505a981114dcb715f8977b8433f7540854851d8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3674d8a8dadd03a447dd21069d4dacfc3399b63b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3ec459c8810e658401be428d3168eacfc380bdd0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/645996efc2ae391246d595832aaa6f9d3cc338c7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8ba7b7c1dad1f6503c541778f31b33f7f62eb966\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c5402fb5f71f1a725f1e55d9c6799c0c7bec308f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fae05b2314b147a78fbed1dc4c645d9a66313758\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fc658c083904427abbf8f18280d517ee2668677c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T23:00:01+00:00",
      "cve": "CVE-2022-49554",
      "id": "CVE-2022-49554",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: zsmalloc: fix races between asynchronous zspage free and page migration",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49554.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T01:13:26Z",
      "cve": "CVE-2022-49554",
      "id": "CVE-2022-49554",
      "initial_release_date": "2025-02-27T03:05:05Z",
      "product_status:known_affected": "106",
      "product_status:known_not_affected": "246",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49554",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49554.json",
      "version": "14"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.