An issue was discovered in the Linux kernel before 5.19. In pxa3xxgcuwrite in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of sizet versus int, causing an integer overflow and bypassing the size check. After that, because it is used as the third argument to copyfrom_user(), a heap overflow may occur. NOTE: the original discoverer disputes that the overflow can actually happen.
{
"isDisputed": true,
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39842.json",
"cna_assigner": "mitre"
}