Summaryinfo

A vulnerability categorized as critical has been discovered in Linux Kernel. This issue affects the function migrate_vma_setup of the component CPU Page. The manipulation results in memory corruption. This vulnerability is cataloged as CVE-2022-49843. There is no exploit available. It is best practice to apply a patch to resolve this issue. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Detailsinfo

A vulnerability was found in Linux Kernel (affected version unknown). It has been classified as critical. Affected is the function migrate_vma_setup of the component CPU Page. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Migrate in CPU page fault use current mm migrate_vma_setup shows below warning because we don't hold another process mm mmap_lock. We should use current vmf->vma->vm_mm instead, the caller already hold current mmap lock inside CPU page fault handler. WARNING: CPU: 10 PID: 3054 at include/linux/mmap_lock.h:155 find_vma Call Trace: walk_page_range+0x76/0x150 migrate_vma_setup+0x18a/0x640 svm_migrate_vram_to_ram+0x245/0xa10 [amdgpu] svm_migrate_to_ram+0x36f/0x470 [amdgpu] do_swap_page+0xcfe/0xec0 __handle_mm_fault+0x96b/0x15e0 handle_mm_fault+0x13f/0x3e0 do_user_addr_fault+0x1e7/0x690

The advisory is available at git.kernel.org. This vulnerability is traded as CVE-2022-49843 since 05/01/2025. The exploitability is told to be easy. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 03/14/2026).

Applying the patch 1dea25e25acd990d7657940ffcab8354c28fa292/128e284c6cccf5875261569fa3bb07558870c17f/3a876060892ba52dd67d197c78b955e62657d906 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2025-0922). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Google Container-Optimized OS
• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• RESF Rocky Linux
• Dell Avamar
• Open Source Linux Kernel
• IBM DataPower Gateway
• Dell NetWorker
• Dell Secure Connect Gateway

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion