CVE-2022-49148
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-49148
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49148.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-49148
- Downstream
- Related
- Published
- 2025-02-26T01:55:15Z
- Modified
- 2025-10-15T18:45:06.448781Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- watch_queue: Free the page array when watch_queue is dismantled
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
watchqueue: Free the page array when watchqueue is dismantled
Commit 7ea1a0124b6d ("watchqueue: Free the alloc bitmap when the watchqueue is torn down") took care of the bitmap, but not the page array.
BUG: memory leak unreferenced object 0xffff88810d9bc140 (size 32): comm "syz-executor335", pid 3603, jiffies 4294946994 (age 12.840s) hex dump (first 32 bytes): 40 a7 40 04 00 ea ff ff 00 00 00 00 00 00 00 00 @.@............. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: kmallocarray include/linux/slab.h:621 [inline] kcalloc include/linux/slab.h:652 [inline] watchqueuesetsize+0x12f/0x2e0 kernel/watchqueue.c:251 pipeioctl+0x82/0x140 fs/pipe.c:632 vfsioctl fs/ioctl.c:51 [inline] _dosysioctl fs/ioctl.c:874 [inline] _sesysioctl fs/ioctl.c:860 [inline] _x64sysioctl+0xfc/0x140 fs/ioctl.c:860 dosyscallx64 arch/x86/entry/common.c:50 [inline]
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/375cd2536494cfbcdda84ae8b3e35bf19d0250b9
- https://git.kernel.org/stable/c/3963a5d1ff75585bddf0c3a918566a6be09d7520
- https://git.kernel.org/stable/c/4913daecd04addb41bc96a9175a885e1c19862a8
- https://git.kernel.org/stable/c/7169f60110915c8b53bffd43741fa020a75eb87a
- https://git.kernel.org/stable/c/b490207017ba237d97b735b2aa66dc241ccd18f5
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedc73be61cede5882f9605a852414db559c0ebedfdFixed7169f60110915c8b53bffd43741fa020a75eb87a
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedc73be61cede5882f9605a852414db559c0ebedfdFixed4913daecd04addb41bc96a9175a885e1c19862a8
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedc73be61cede5882f9605a852414db559c0ebedfdFixed3963a5d1ff75585bddf0c3a918566a6be09d7520
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedc73be61cede5882f9605a852414db559c0ebedfdFixed375cd2536494cfbcdda84ae8b3e35bf19d0250b9
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedc73be61cede5882f9605a852414db559c0ebedfdFixedb490207017ba237d97b735b2aa66dc241ccd18f5
Affected versions
v5.*
v5.10
v5.10-rc1
v5.10-rc2
v5.10-rc3
v5.10-rc4
v5.10-rc5
v5.10-rc6
v5.10-rc7
v5.10.1
v5.10.10
v5.10.100
v5.10.101
v5.10.102
v5.10.103
v5.10.104
v5.10.105
v5.10.106
v5.10.107
v5.10.108
v5.10.109
v5.10.11
v5.10.12
v5.10.13
v5.10.14
v5.10.15
v5.10.16
v5.10.17
v5.10.18
v5.10.19
v5.10.2
v5.10.20
v5.10.21
v5.10.22
v5.10.23
v5.10.24
v5.10.25
v5.10.26
v5.10.27
v5.10.28
v5.10.29
v5.10.3
v5.10.30
v5.10.31
v5.10.32
v5.10.33
v5.10.34
v5.10.35
v5.10.36
v5.10.37
v5.10.38
v5.10.39
v5.10.4
v5.10.40
v5.10.41
v5.10.42
v5.10.43
v5.10.44
v5.10.45
v5.10.46
v5.10.47
v5.10.48
v5.10.49
v5.10.5
v5.10.50
v5.10.51
v5.10.52
v5.10.53
v5.10.54
v5.10.55
v5.10.56
v5.10.57
v5.10.58
v5.10.59
v5.10.6
v5.10.60
v5.10.61
v5.10.62
v5.10.63
v5.10.64
v5.10.65
v5.10.66
v5.10.67
v5.10.68
v5.10.69
v5.10.7
v5.10.70
v5.10.71
v5.10.72
v5.10.73
v5.10.74
v5.10.75
v5.10.76
v5.10.77
v5.10.78
v5.10.79
v5.10.8
v5.10.80
v5.10.81
v5.10.82
v5.10.83
v5.10.84
v5.10.85
v5.10.86
v5.10.87
v5.10.88
v5.10.89
v5.10.9
v5.10.90
v5.10.91
v5.10.92
v5.10.93
v5.10.94
v5.10.95
v5.10.96
v5.10.97
v5.10.98
v5.10.99
v5.11
v5.11-rc1
v5.11-rc2
v5.11-rc3
v5.11-rc4
v5.11-rc5
v5.11-rc6
v5.11-rc7
v5.12
v5.12-rc1
v5.12-rc1-dontuse
v5.12-rc2
v5.12-rc3
v5.12-rc4
v5.12-rc5
v5.12-rc6
v5.12-rc7
v5.12-rc8
v5.13
v5.13-rc1
v5.13-rc2
v5.13-rc3
v5.13-rc4
v5.13-rc5
v5.13-rc6
v5.13-rc7
v5.14
v5.14-rc1
v5.14-rc2
v5.14-rc3
v5.14-rc4
v5.14-rc5
v5.14-rc6
v5.14-rc7
v5.15
v5.15-rc1
v5.15-rc2
v5.15-rc3
v5.15-rc4
v5.15-rc5
v5.15-rc6
v5.15-rc7
v5.15.1
v5.15.10
v5.15.11
v5.15.12
v5.15.13
v5.15.14
v5.15.15
v5.15.16
v5.15.17
v5.15.18
v5.15.19
v5.15.2
v5.15.20
v5.15.21
v5.15.22
v5.15.23
v5.15.24
v5.15.25
v5.15.26
v5.15.27
v5.15.28
v5.15.29
v5.15.3
v5.15.30
v5.15.31
v5.15.32
v5.15.4
v5.15.5
v5.15.6
v5.15.7
v5.15.8
v5.15.9
v5.16
v5.16-rc1
v5.16-rc2
v5.16-rc3
v5.16-rc4
v5.16-rc5
v5.16-rc6
v5.16-rc7
v5.16-rc8
v5.16.1
v5.16.10
v5.16.11
v5.16.12
v5.16.13
v5.16.14
v5.16.15
v5.16.16
v5.16.17
v5.16.18
v5.16.2
v5.16.3
v5.16.4
v5.16.5
v5.16.6
v5.16.7
v5.16.8
v5.16.9
v5.17
v5.17-rc1
v5.17-rc2
v5.17-rc3
v5.17-rc4
v5.17-rc5
v5.17-rc6
v5.17-rc7
v5.17-rc8
v5.17.1
v5.7
v5.7-rc7
v5.8
v5.8-rc1
v5.8-rc2
v5.8-rc3
v5.8-rc4
v5.8-rc5
v5.8-rc6
v5.8-rc7
v5.9
v5.9-rc1
v5.9-rc2
v5.9-rc3
v5.9-rc4
v5.9-rc5
v5.9-rc6
v5.9-rc7
v5.9-rc8
Database specific
vanir_signatures
[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"7385285169549115365754590834437237211",
"64022806558627958014125688733492320974",
"17849375289093934946968564966911453733",
"325842666491615808973655647093253109489"
]
},
"target": {
"file": "kernel/watch_queue.c"
},
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@375cd2536494cfbcdda84ae8b3e35bf19d0250b9",
"id": "CVE-2022-49148-0cb3e662",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"7385285169549115365754590834437237211",
"64022806558627958014125688733492320974",
"17849375289093934946968564966911453733",
"325842666491615808973655647093253109489"
]
},
"target": {
"file": "kernel/watch_queue.c"
},
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3963a5d1ff75585bddf0c3a918566a6be09d7520",
"id": "CVE-2022-49148-439dec6d",
"deprecated": false
},
{
"digest": {
"function_hash": "286550649833545512382396947159538248302",
"length": 384.0
},
"target": {
"file": "kernel/watch_queue.c",
"function": "__put_watch_queue"
},
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4913daecd04addb41bc96a9175a885e1c19862a8",
"id": "CVE-2022-49148-7dfa65c7",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"7385285169549115365754590834437237211",
"64022806558627958014125688733492320974",
"17849375289093934946968564966911453733",
"325842666491615808973655647093253109489"
]
},
"target": {
"file": "kernel/watch_queue.c"
},
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4913daecd04addb41bc96a9175a885e1c19862a8",
"id": "CVE-2022-49148-b1605933",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"7385285169549115365754590834437237211",
"64022806558627958014125688733492320974",
"17849375289093934946968564966911453733",
"325842666491615808973655647093253109489"
]
},
"target": {
"file": "kernel/watch_queue.c"
},
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b490207017ba237d97b735b2aa66dc241ccd18f5",
"id": "CVE-2022-49148-b5f07e7a",
"deprecated": false
},
{
"digest": {
"function_hash": "286550649833545512382396947159538248302",
"length": 384.0
},
"target": {
"file": "kernel/watch_queue.c",
"function": "__put_watch_queue"
},
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b490207017ba237d97b735b2aa66dc241ccd18f5",
"id": "CVE-2022-49148-c320c8b6",
"deprecated": false
},
{
"digest": {
"function_hash": "286550649833545512382396947159538248302",
"length": 384.0
},
"target": {
"file": "kernel/watch_queue.c",
"function": "__put_watch_queue"
},
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@375cd2536494cfbcdda84ae8b3e35bf19d0250b9",
"id": "CVE-2022-49148-d430d434",
"deprecated": false
},
{
"digest": {
"function_hash": "286550649833545512382396947159538248302",
"length": 384.0
},
"target": {
"file": "kernel/watch_queue.c",
"function": "__put_watch_queue"
},
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7169f60110915c8b53bffd43741fa020a75eb87a",
"id": "CVE-2022-49148-d5498141",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"7385285169549115365754590834437237211",
"64022806558627958014125688733492320974",
"17849375289093934946968564966911453733",
"325842666491615808973655647093253109489"
]
},
"target": {
"file": "kernel/watch_queue.c"
},
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7169f60110915c8b53bffd43741fa020a75eb87a",
"id": "CVE-2022-49148-e151e2df",
"deprecated": false
},
{
"digest": {
"function_hash": "286550649833545512382396947159538248302",
"length": 384.0
},
"target": {
"file": "kernel/watch_queue.c",
"function": "__put_watch_queue"
},
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3963a5d1ff75585bddf0c3a918566a6be09d7520",
"id": "CVE-2022-49148-ed54197c",
"deprecated": false
}
]