GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49723 (GCVE-0-2022-49723)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:24 – Updated: 2026-05-11 19:05
VLAI
Title
drm/i915/reset: Fix error_state_read ptr + offset use
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/i915/reset: Fix error_state_read ptr + offset use Fix our pointer offset usage in error_state_read when there is no i915_gpu_coredump but buf offset is non-zero. This fixes a kernel page fault can happen when multiple tests are running concurrently in a loop and one is producing engine resets and consuming the i915 error_state dump while the other is forcing full GT resets. (takes a while to trigger). The dmesg call trace: [ 5590.803000] BUG: unable to handle page fault for address: ffffffffa0b0e000 [ 5590.803009] #PF: supervisor read access in kernel mode [ 5590.803013] #PF: error_code(0x0000) - not-present page [ 5590.803016] PGD 5814067 P4D 5814067 PUD 5815063 PMD 109de4067 PTE 0 [ 5590.803022] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 5590.803026] CPU: 5 PID: 13656 Comm: i915_hangman Tainted: G U 5.17.0-rc5-ups69-guc-err-capt-rev6+ #136 [ 5590.803033] Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-M LP4x RVP, BIOS ADLPFWI1.R00. 3031.A02.2201171222 01/17/2022 [ 5590.803039] RIP: 0010:memcpy_erms+0x6/0x10 [ 5590.803045] Code: fe ff ff cc eb 1e 0f 1f 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 <f3> a4 c3 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20 72 7e 40 38 fe [ 5590.803054] RSP: 0018:ffffc90003a8fdf0 EFLAGS: 00010282 [ 5590.803057] RAX: ffff888107ee9000 RBX: ffff888108cb1a00 RCX: 0000000000000f8f [ 5590.803061] RDX: 0000000000001000 RSI: ffffffffa0b0e000 RDI: ffff888107ee9071 [ 5590.803065] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001 [ 5590.803069] R10: 0000000000000001 R11: 0000000000000002 R12: 0000000000000019 [ 5590.803073] R13: 0000000000174fff R14: 0000000000001000 R15: ffff888107ee9000 [ 5590.803077] FS: 00007f62a99bee80(0000) GS:ffff88849f880000(0000) knlGS:0000000000000000 [ 5590.803082] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5590.803085] CR2: ffffffffa0b0e000 CR3: 000000010a1a8004 CR4: 0000000000770ee0 [ 5590.803089] PKRU: 55555554 [ 5590.803091] Call Trace: [ 5590.803093] <TASK> [ 5590.803096] error_state_read+0xa1/0xd0 [i915] [ 5590.803175] kernfs_fop_read_iter+0xb2/0x1b0 [ 5590.803180] new_sync_read+0x116/0x1a0 [ 5590.803185] vfs_read+0x114/0x1b0 [ 5590.803189] ksys_read+0x63/0xe0 [ 5590.803193] do_syscall_64+0x38/0xc0 [ 5590.803197] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 5590.803201] RIP: 0033:0x7f62aaea5912 [ 5590.803204] Code: c0 e9 b2 fe ff ff 50 48 8d 3d 5a b9 0c 00 e8 05 19 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24 [ 5590.803213] RSP: 002b:00007fff5b659ae8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 5590.803218] RAX: ffffffffffffffda RBX: 0000000000100000 RCX: 00007f62aaea5912 [ 5590.803221] RDX: 000000000008b000 RSI: 00007f62a8c4000f RDI: 0000000000000006 [ 5590.803225] RBP: 00007f62a8bcb00f R08: 0000000000200010 R09: 0000000000101000 [ 5590.803229] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000006 [ 5590.803233] R13: 0000000000075000 R14: 00007f62a8acb010 R15: 0000000000200000 [ 5590.803238] </TASK> [ 5590.803240] Modules linked in: i915 ttm drm_buddy drm_dp_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops prime_numbers nfnetlink br_netfilter overlay mei_pxp mei_hdcp x86_pkg_temp_thermal coretemp kvm_intel snd_hda_codec_hdmi snd_hda_intel ---truncated---
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0e39037b3165567660b0e03f67534da5269a0465 , < 63b26fe0252f923e6aca373e3ad4b31202dcd331 (git)
Affected: 0e39037b3165567660b0e03f67534da5269a0465 , < f4c5eba87675a07a6c28cdaca7366aeb4258ec78 (git)
Affected: 0e39037b3165567660b0e03f67534da5269a0465 , < 606e5d565605e26bf61a0933a6d56940f339c080 (git)
Affected: 0e39037b3165567660b0e03f67534da5269a0465 , < c9b576d0c7bf55aeae1a736da7974fa202c4394d (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.0
Unaffected: 0 , < 5.0 (semver)
Unaffected: 5.10.124 , ≤ 5.10.* (semver)
Unaffected: 5.15.49 , ≤ 5.15.* (semver)
Unaffected: 5.18.6 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/i915_sysfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "63b26fe0252f923e6aca373e3ad4b31202dcd331",
              "status": "affected",
              "version": "0e39037b3165567660b0e03f67534da5269a0465",
              "versionType": "git"
            },
            {
              "lessThan": "f4c5eba87675a07a6c28cdaca7366aeb4258ec78",
              "status": "affected",
              "version": "0e39037b3165567660b0e03f67534da5269a0465",
              "versionType": "git"
            },
            {
              "lessThan": "606e5d565605e26bf61a0933a6d56940f339c080",
              "status": "affected",
              "version": "0e39037b3165567660b0e03f67534da5269a0465",
              "versionType": "git"
            },
            {
              "lessThan": "c9b576d0c7bf55aeae1a736da7974fa202c4394d",
              "status": "affected",
              "version": "0e39037b3165567660b0e03f67534da5269a0465",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/i915_sysfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.124",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.124",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.49",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.6",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/reset: Fix error_state_read ptr + offset use\n\nFix our pointer offset usage in error_state_read\nwhen there is no i915_gpu_coredump but buf offset\nis non-zero.\n\nThis fixes a kernel page fault can happen when\nmultiple tests are running concurrently in a loop\nand one is producing engine resets and consuming\nthe i915 error_state dump while the other is\nforcing full GT resets. (takes a while to trigger).\n\nThe dmesg call trace:\n\n[ 5590.803000] BUG: unable to handle page fault for address:\n               ffffffffa0b0e000\n[ 5590.803009] #PF: supervisor read access in kernel mode\n[ 5590.803013] #PF: error_code(0x0000) - not-present page\n[ 5590.803016] PGD 5814067 P4D 5814067 PUD 5815063 PMD 109de4067\n               PTE 0\n[ 5590.803022] Oops: 0000 [#1] PREEMPT SMP NOPTI\n[ 5590.803026] CPU: 5 PID: 13656 Comm: i915_hangman Tainted: G U\n                    5.17.0-rc5-ups69-guc-err-capt-rev6+ #136\n[ 5590.803033] Hardware name: Intel Corporation Alder Lake Client\n                    Platform/AlderLake-M LP4x RVP, BIOS ADLPFWI1.R00.\n                    3031.A02.2201171222\t01/17/2022\n[ 5590.803039] RIP: 0010:memcpy_erms+0x6/0x10\n[ 5590.803045] Code: fe ff ff cc eb 1e 0f 1f 00 48 89 f8 48 89 d1\n                     48 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3\n                     66 0f 1f 44 00 00 48 89 f8 48 89 d1 \u003cf3\u003e a4\n                     c3 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20\n                     72 7e 40 38 fe\n[ 5590.803054] RSP: 0018:ffffc90003a8fdf0 EFLAGS: 00010282\n[ 5590.803057] RAX: ffff888107ee9000 RBX: ffff888108cb1a00\n               RCX: 0000000000000f8f\n[ 5590.803061] RDX: 0000000000001000 RSI: ffffffffa0b0e000\n               RDI: ffff888107ee9071\n[ 5590.803065] RBP: 0000000000000000 R08: 0000000000000001\n               R09: 0000000000000001\n[ 5590.803069] R10: 0000000000000001 R11: 0000000000000002\n               R12: 0000000000000019\n[ 5590.803073] R13: 0000000000174fff R14: 0000000000001000\n               R15: ffff888107ee9000\n[ 5590.803077] FS: 00007f62a99bee80(0000) GS:ffff88849f880000(0000)\n               knlGS:0000000000000000\n[ 5590.803082] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 5590.803085] CR2: ffffffffa0b0e000 CR3: 000000010a1a8004\n               CR4: 0000000000770ee0\n[ 5590.803089] PKRU: 55555554\n[ 5590.803091] Call Trace:\n[ 5590.803093] \u003cTASK\u003e\n[ 5590.803096] error_state_read+0xa1/0xd0 [i915]\n[ 5590.803175] kernfs_fop_read_iter+0xb2/0x1b0\n[ 5590.803180] new_sync_read+0x116/0x1a0\n[ 5590.803185] vfs_read+0x114/0x1b0\n[ 5590.803189] ksys_read+0x63/0xe0\n[ 5590.803193] do_syscall_64+0x38/0xc0\n[ 5590.803197] entry_SYSCALL_64_after_hwframe+0x44/0xae\n[ 5590.803201] RIP: 0033:0x7f62aaea5912\n[ 5590.803204] Code: c0 e9 b2 fe ff ff 50 48 8d 3d 5a b9 0c 00 e8 05\n                     19 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25\n                     18 00 00 00 85 c0 75 10 0f 05 \u003c48\u003e 3d 00 f0 ff\n                     ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24\n[ 5590.803213] RSP: 002b:00007fff5b659ae8 EFLAGS: 00000246\n               ORIG_RAX: 0000000000000000\n[ 5590.803218] RAX: ffffffffffffffda RBX: 0000000000100000\n               RCX: 00007f62aaea5912\n[ 5590.803221] RDX: 000000000008b000 RSI: 00007f62a8c4000f\n               RDI: 0000000000000006\n[ 5590.803225] RBP: 00007f62a8bcb00f R08: 0000000000200010\n               R09: 0000000000101000\n[ 5590.803229] R10: 0000000000000001 R11: 0000000000000246\n               R12: 0000000000000006\n[ 5590.803233] R13: 0000000000075000 R14: 00007f62a8acb010\n               R15: 0000000000200000\n[ 5590.803238] \u003c/TASK\u003e\n[ 5590.803240] Modules linked in: i915 ttm drm_buddy drm_dp_helper\n                        drm_kms_helper syscopyarea sysfillrect sysimgblt\n                        fb_sys_fops prime_numbers nfnetlink br_netfilter\n                        overlay mei_pxp mei_hdcp x86_pkg_temp_thermal\n                        coretemp kvm_intel snd_hda_codec_hdmi snd_hda_intel\n        \n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:05:36.280Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/63b26fe0252f923e6aca373e3ad4b31202dcd331"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4c5eba87675a07a6c28cdaca7366aeb4258ec78"
        },
        {
          "url": "https://git.kernel.org/stable/c/606e5d565605e26bf61a0933a6d56940f339c080"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9b576d0c7bf55aeae1a736da7974fa202c4394d"
        }
      ],
      "title": "drm/i915/reset: Fix error_state_read ptr + offset use",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49723",
    "datePublished": "2025-02-26T02:24:36.049Z",
    "dateReserved": "2025-02-26T02:21:30.447Z",
    "dateUpdated": "2026-05-11T19:05:36.280Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49723",
      "date": "2026-09-17",
      "epss": "0.00273",
      "percentile": "0.1982"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49723\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:47.980\",\"lastModified\":\"2026-06-17T05:18:58.213\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/i915/reset: Fix error_state_read ptr + offset use\\n\\nFix our pointer offset usage in error_state_read\\nwhen there is no i915_gpu_coredump but buf offset\\nis non-zero.\\n\\nThis fixes a kernel page fault can happen when\\nmultiple tests are running concurrently in a loop\\nand one is producing engine resets and consuming\\nthe i915 error_state dump while the other is\\nforcing full GT resets. (takes a while to trigger).\\n\\nThe dmesg call trace:\\n\\n[ 5590.803000] BUG: unable to handle page fault for address:\\n               ffffffffa0b0e000\\n[ 5590.803009] #PF: supervisor read access in kernel mode\\n[ 5590.803013] #PF: error_code(0x0000) - not-present page\\n[ 5590.803016] PGD 5814067 P4D 5814067 PUD 5815063 PMD 109de4067\\n               PTE 0\\n[ 5590.803022] Oops: 0000 [#1] PREEMPT SMP NOPTI\\n[ 5590.803026] CPU: 5 PID: 13656 Comm: i915_hangman Tainted: G U\\n                    5.17.0-rc5-ups69-guc-err-capt-rev6+ #136\\n[ 5590.803033] Hardware name: Intel Corporation Alder Lake Client\\n                    Platform/AlderLake-M LP4x RVP, BIOS ADLPFWI1.R00.\\n                    3031.A02.2201171222\\t01/17/2022\\n[ 5590.803039] RIP: 0010:memcpy_erms+0x6/0x10\\n[ 5590.803045] Code: fe ff ff cc eb 1e 0f 1f 00 48 89 f8 48 89 d1\\n                     48 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3\\n                     66 0f 1f 44 00 00 48 89 f8 48 89 d1 \u003cf3\u003e a4\\n                     c3 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20\\n                     72 7e 40 38 fe\\n[ 5590.803054] RSP: 0018:ffffc90003a8fdf0 EFLAGS: 00010282\\n[ 5590.803057] RAX: ffff888107ee9000 RBX: ffff888108cb1a00\\n               RCX: 0000000000000f8f\\n[ 5590.803061] RDX: 0000000000001000 RSI: ffffffffa0b0e000\\n               RDI: ffff888107ee9071\\n[ 5590.803065] RBP: 0000000000000000 R08: 0000000000000001\\n               R09: 0000000000000001\\n[ 5590.803069] R10: 0000000000000001 R11: 0000000000000002\\n               R12: 0000000000000019\\n[ 5590.803073] R13: 0000000000174fff R14: 0000000000001000\\n               R15: ffff888107ee9000\\n[ 5590.803077] FS: 00007f62a99bee80(0000) GS:ffff88849f880000(0000)\\n               knlGS:0000000000000000\\n[ 5590.803082] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[ 5590.803085] CR2: ffffffffa0b0e000 CR3: 000000010a1a8004\\n               CR4: 0000000000770ee0\\n[ 5590.803089] PKRU: 55555554\\n[ 5590.803091] Call Trace:\\n[ 5590.803093] \u003cTASK\u003e\\n[ 5590.803096] error_state_read+0xa1/0xd0 [i915]\\n[ 5590.803175] kernfs_fop_read_iter+0xb2/0x1b0\\n[ 5590.803180] new_sync_read+0x116/0x1a0\\n[ 5590.803185] vfs_read+0x114/0x1b0\\n[ 5590.803189] ksys_read+0x63/0xe0\\n[ 5590.803193] do_syscall_64+0x38/0xc0\\n[ 5590.803197] entry_SYSCALL_64_after_hwframe+0x44/0xae\\n[ 5590.803201] RIP: 0033:0x7f62aaea5912\\n[ 5590.803204] Code: c0 e9 b2 fe ff ff 50 48 8d 3d 5a b9 0c 00 e8 05\\n                     19 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25\\n                     18 00 00 00 85 c0 75 10 0f 05 \u003c48\u003e 3d 00 f0 ff\\n                     ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24\\n[ 5590.803213] RSP: 002b:00007fff5b659ae8 EFLAGS: 00000246\\n               ORIG_RAX: 0000000000000000\\n[ 5590.803218] RAX: ffffffffffffffda RBX: 0000000000100000\\n               RCX: 00007f62aaea5912\\n[ 5590.803221] RDX: 000000000008b000 RSI: 00007f62a8c4000f\\n               RDI: 0000000000000006\\n[ 5590.803225] RBP: 00007f62a8bcb00f R08: 0000000000200010\\n               R09: 0000000000101000\\n[ 5590.803229] R10: 0000000000000001 R11: 0000000000000246\\n               R12: 0000000000000006\\n[ 5590.803233] R13: 0000000000075000 R14: 00007f62a8acb010\\n               R15: 0000000000200000\\n[ 5590.803238] \u003c/TASK\u003e\\n[ 5590.803240] Modules linked in: i915 ttm drm_buddy drm_dp_helper\\n                        drm_kms_helper syscopyarea sysfillrect sysimgblt\\n                        fb_sys_fops prime_numbers nfnetlink br_netfilter\\n                        overlay mei_pxp mei_hdcp x86_pkg_temp_thermal\\n                        coretemp kvm_intel snd_hda_codec_hdmi snd_hda_intel\\n        \\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/i915/reset: Se corrige el uso de ptr + offset de error_state_read Se corrige el uso de offset del puntero en error_state_read cuando no hay i915_gpu_coredump pero el offset de buf no es cero. Esto corrige un error de p\u00e1gina del kernel que puede ocurrir cuando se ejecutan varias pruebas simult\u00e1neamente en un bucle y una produce reinicios del motor y consume el volcado de error_state de i915 mientras que la otra fuerza reinicios completos de GT. (tarda un tiempo en activarse). El seguimiento de la llamada dmesg: [5590.803000] ERROR: no se puede manejar el error de p\u00e1gina para la direcci\u00f3n:  ffffffffa0b0e000 [ 5590.803009] #PF: supervisor read access in kernel mode [ 5590.803013] #PF: error_code(0x0000) - not-present page [ 5590.803016] PGD 5814067 P4D 5814067 PUD 5815063 PMD 109de4067 PTE 0 [ 5590.803022] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 5590.803026] CPU: 5 PID: 13656 Comm: i915_hangman Tainted: G U 5.17.0-rc5-ups69-guc-err-capt-rev6+ #136 [ 5590.803033] Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-M LP4x RVP, BIOS ADLPFWI1.R00. 3031.A02.2201171222 01/17/2022 [ 5590.803039] RIP: 0010:memcpy_erms+0x6/0x10 [ 5590.803045] Code: fe ff ff cc eb 1e 0f 1f 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1  a4 c3 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20 72 7e 40 38 fe [ 5590.803054] RSP: 0018:ffffc90003a8fdf0 EFLAGS: 00010282 [ 5590.803057] RAX: ffff888107ee9000 RBX: ffff888108cb1a00 RCX: 0000000000000f8f [ 5590.803061] RDX: 0000000000001000 RSI: ffffffffa0b0e000 RDI: ffff888107ee9071 [ 5590.803065] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001 [ 5590.803069] R10: 0000000000000001 R11: 0000000000000002 R12: 0000000000000019 [ 5590.803073] R13: 0000000000174fff R14: 0000000000001000 R15: ffff888107ee9000 [ 5590.803077] FS: 00007f62a99bee80(0000) GS:ffff88849f880000(0000) knlGS:0000000000000000 [ 5590.803082] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5590.803085] CR2: ffffffffa0b0e000 CR3: 000000010a1a8004 CR4: 0000000000770ee0 [ 5590.803089] PKRU: 55555554 [ 5590.803091] Call Trace: [ 5590.803093]  [ 5590.803096] error_state_read+0xa1/0xd0 [i915] [ 5590.803175] kernfs_fop_read_iter+0xb2/0x1b0 [ 5590.803180] new_sync_read+0x116/0x1a0 [ 5590.803185] vfs_read+0x114/0x1b0 [ 5590.803189] ksys_read+0x63/0xe0 [ 5590.803193] do_syscall_64+0x38/0xc0 [ 5590.803197] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 5590.803201] RIP: 0033:0x7f62aaea5912 [ 5590.803204] Code: c0 e9 b2 fe ff ff 50 48 8d 3d 5a b9 0c 00 e8 05 19 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 \u0026lt;48\u0026gt; 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24 [ 5590.803213] RSP: 002b:00007fff5b659ae8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 5590.803218] RAX: ffffffffffffffda RBX: 0000000000100000 RCX: 00007f62aaea5912 [ 5590.803221] RDX: 000000000008b000 RSI: 00007f62a8c4000f RDI: 0000000000000006 [ 5590.803225] RBP: 00007f62a8bcb00f R08: 0000000000200010 R09: 0000000000101000 [ 5590.803229] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000006 [ 5590.803233] R13: 0000000000075000 R14: 00007f62a8acb010 R15: 0000000000200000 [ 5590.803238]  [ 5590.803240] Modules linked in: i915 ttm drm_buddy drm_dp_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops prime_numbers nfnetlink br_netfilter overlay mei_pxp mei_hdcp x86_pkg_temp_thermal coretemp kvm_intel snd_hda_codec_hdmi snd_hda_intel ---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/i915/i915_sysfs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0e39037b3165567660b0e03f67534da5269a0465\",\"lessThan\":\"63b26fe0252f923e6aca373e3ad4b31202dcd331\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0e39037b3165567660b0e03f67534da5269a0465\",\"lessThan\":\"f4c5eba87675a07a6c28cdaca7366aeb4258ec78\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0e39037b3165567660b0e03f67534da5269a0465\",\"lessThan\":\"606e5d565605e26bf61a0933a6d56940f339c080\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0e39037b3165567660b0e03f67534da5269a0465\",\"lessThan\":\"c9b576d0c7bf55aeae1a736da7974fa202c4394d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/i915/i915_sysfs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.124\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.49\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18.6\",\"lessThanOrEqual\":\"5.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.0\",\"versionEndExcluding\":\"5.10.124\",\"matchCriteriaId\":\"044455BD-F3EC-4391-B065-7AD0CC0CC004\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.49\",\"matchCriteriaId\":\"697D250E-E0A4-41BE-BB54-96385E129206\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.18.6\",\"matchCriteriaId\":\"CDD33A19-B51E-4090-A47B-073098916815\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"A8C30C2D-F82D-4D37-AB48-D76ABFBD5377\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"BF8547FC-C849-4F1B-804B-A93AE2F04A92\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/606e5d565605e26bf61a0933a6d56940f339c080\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/63b26fe0252f923e6aca373e3ad4b31202dcd331\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c9b576d0c7bf55aeae1a736da7974fa202c4394d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f4c5eba87675a07a6c28cdaca7366aeb4258ec78\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-30T10:38:52+00:00",
      "cve": "CVE-2022-49723",
      "id": "CVE-2022-49723",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "321",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "92",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/i915/reset: Fix error_state_read ptr + offset use",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49723.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T01:26:33Z",
      "cve": "CVE-2022-49723",
      "id": "CVE-2022-49723",
      "initial_release_date": "2025-02-27T03:02:14Z",
      "product_status:known_affected": "360",
      "product_status:known_not_affected": "344",
      "product_status:recommended": "340",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49723",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49723.json",
      "version": "51"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.