In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Fix stale file descriptors on failed usercopy
A failing usercopy of the fencerep object will lead to a stale entry in the file descriptor table as putunused_fd() won't release it. This enables userland to refer to a dangling 'file' object through that still valid file descriptor, leading to all kinds of use-after-free exploitation scenarios.
Fix this by deferring the call to fd_install() until after the usercopy has succeeded.
[
    {
        "id": "CVE-2022-48771-09de0377",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c",
            "function": "vmw_fence_event_ioctl"
        },
        "digest": {
            "function_hash": "30860537817470133912543821291419534698",
            "length": 1424.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8d092a62449dcfc73517ca43963d2b8f44d0516"
    },
    {
        "id": "CVE-2022-48771-229b2ab7",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c",
            "function": "vmw_execbuf_process"
        },
        "digest": {
            "function_hash": "196223619825923057038885380458634735719",
            "length": 4879.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8d092a62449dcfc73517ca43963d2b8f44d0516"
    },
    {
        "id": "CVE-2022-48771-3c1acec4",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/gpu/drm/vmwgfx/vmwgfx_kms.c",
            "function": "vmw_kms_helper_buffer_finish"
        },
        "digest": {
            "function_hash": "276771357433634537331662516529241502085",
            "length": 426.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8d092a62449dcfc73517ca43963d2b8f44d0516"
    },
    {
        "id": "CVE-2022-48771-45f080ce",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c",
            "function": "vmw_execbuf_copy_fence_user"
        },
        "digest": {
            "function_hash": "324821028146700120688056443673544608548",
            "length": 861.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8d092a62449dcfc73517ca43963d2b8f44d0516"
    },
    {
        "id": "CVE-2022-48771-4ad48b1a",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/gpu/drm/vmwgfx/vmwgfx_kms.c"
        },
        "digest": {
            "line_hashes": [
                "192803166294407843540619709630415853442",
                "11015832587194791636720030304465836112",
                "135332326658543865660959160984235447273",
                "222333738978743066990602803843494470665"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8d092a62449dcfc73517ca43963d2b8f44d0516"
    },
    {
        "id": "CVE-2022-48771-53b32f4e",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"
        },
        "digest": {
            "line_hashes": [
                "171823706273444294788313458964035500092",
                "248827478862896300848671380743239687905",
                "229153070911317684991108437866314451966",
                "170233072040565158791111884813734479275",
                "157856859553697195748664887699008530296",
                "126473971311352236891299869073419540836",
                "65899791715696289868753766017029982845",
                "134377543355494802127270517529802780409",
                "80006179933305689720311750724315039957",
                "260116815322800655256643132818538600738",
                "251558327954635165798834135955237813511",
                "108833167354270590979986351929795948152",
                "55780024402151537389444255208875254340",
                "315448820024193434162901977644031399478",
                "316263280581411751016955379948468689340",
                "337483725624042218634683576133247071107",
                "60547649229989505596495031398253448669",
                "77399790567705675238116156592939742532",
                "328281978427944298236085552163817912304",
                "273837625091961654149689847439867123747",
                "122019400724324123375640210169061074686",
                "82772965084949668257730933898815250850",
                "218115619550638015729344943234631614122",
                "55425062840045615747303185239140973552",
                "254898965300996184473287122988693147030",
                "117044619932630407101340547883523257147",
                "263108102149615777136271826733160412678",
                "100914717187965379551360499116742108473",
                "171648862225052200538205292815840695853",
                "17809887814068595460308471254374372298",
                "192711777332491960021766234565092805248",
                "158605130451068493603457227252966993855",
                "70180099351764365825692697985636039791",
                "14628414007055311848409627808659284256",
                "140399491872295533256174622422668219298",
                "8123805526437474039693907475491338672",
                "186318144925115438460025705850854351824",
                "255286504497315383982767452004595795144",
                "83990623525234399299546803602202526332",
                "279950777774505689423319200251122046296",
                "196821658944067469807682304283409654732",
                "335315009756152969641502816337506163789",
                "173037575600472484324057620015172376766",
                "175300775631932521407800666009550478479",
                "230980410587655764577542302914633630495",
                "116743926610250655803610093446288894967"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8d092a62449dcfc73517ca43963d2b8f44d0516"
    },
    {
        "id": "CVE-2022-48771-69d73a33",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/gpu/drm/vmwgfx/vmwgfx_fence.c"
        },
        "digest": {
            "line_hashes": [
                "87706378272752051407218268047468342497",
                "269537118407127054528523308471431376139",
                "77892218113255902298418012719276977712",
                "85799959512851005001397664433075634740"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8d092a62449dcfc73517ca43963d2b8f44d0516"
    },
    {
        "id": "CVE-2022-48771-a60428e8",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/gpu/drm/vmwgfx/vmwgfx_drv.h"
        },
        "digest": {
            "line_hashes": [
                "327356423874068994657886449202112375733",
                "198530050478604672667351540774906530138",
                "328296491391609040263494673468562176477",
                "261487792823826159289760460033616956213",
                "95742131442178283916732486842002643224",
                "288769463668061253856715584018878666671",
                "201845551549556431514520445664238470640",
                "39703825151272769477868859713462879814",
                "36183792610835316376423948685355114286",
                "209263925405977802941564258275447423543",
                "149379710274683423896319532471920643495",
                "186638081430873276391757877891671097538"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8d092a62449dcfc73517ca43963d2b8f44d0516"
    }
]