Log in Start free

Vulnerability · Published Feb 26, 2025 · Assigned by Linux

CVE-2022-49489drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume

High 7.8

In plain English

A high-severity use-after-free in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.3%top 79.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume BUG: Unable to handle kernel paging request at virtual address 006b6b6b6b6b6be3 Call trace: dpu_vbif_init_memtypes+0x40/0xb8 dpu_runtime_resume+0xcc/0x1c0 pm_generic_runtime_resume+0x30/0x44 __genpd_runtime_resume+0x68/0x7c genpd_runtime_resume+0x134/0x258 __rpm_callback+0x98/0x138 rpm_callback+0x30/0x88 rpm_resume+0x36c/0x49c __pm_runtime_resume+0x80/0xb0 dpu_core_irq_uninstall+0x30/0xb0 dpu_irq_uninstall+0x18/0x24 msm_drm_uninit+0xd8/0x16c Patchwork: https://patchwork.freedesktop.org/patch/483255/ [DB: fixed Fixes tag]

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.18.5-1DEBIAN-CVE-2022-49489
Debian:13linux5.18.5-1DEBIAN-CVE-2022-49489
Debian:14linux5.18.5-1DEBIAN-CVE-2022-49489
Ubuntu:22.04:LTSlinux5.15.0-47.51UBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-aws5.15.0-1019.23UBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-azure5.15.0-1019.24UBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-gcp5.15.0-1017.23UBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-gke5.15.0-1015.18UBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1002.4UBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-ibm5.15.0-1013.15UBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1015.20UBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-kvm5.15.0-1017.21UBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-47.53UBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1007.7UBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-oracle5.15.0-1017.22UBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-raspi5.15.0-1014.16UBUNTU-CVE-2022-49489
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2022-49489
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2022-49489

Affected products (as reported)

VendorProductVersions
Linux Linux 25fdd5933e4c0f5fe2ea5cd59994f8ac5fbe90ef – before aa4cb188988dc6f1b3f4917d4dbc452150a5d87125fdd5933e4c0f5fe2ea5cd59994f8ac5fbe90ef – before ef10d0c68e8608848cd58fca258968571842660725fdd5933e4c0f5fe2ea5cd59994f8ac5fbe90ef – before 134760263f6441741db0b2970e7face6b34b6d1c25fdd5933e4c0f5fe2ea5cd59994f8ac5fbe90ef – before ef4bdaac7cb5416f236613ed9337ff0ea8ee329b25fdd5933e4c0f5fe2ea5cd59994f8ac5fbe90ef – before 97ac682b6f7d36be5d934f86c9911066540a68f125fdd5933e4c0f5fe2ea5cd59994f8ac5fbe90ef – before 5b0adf5cbf3b74721e4e4c4e0cadc91b8df8bcc225fdd5933e4c0f5fe2ea5cd59994f8ac5fbe90ef – before fa5186b279ecf44b14fb435540d2065be91cb1ed
Linux Linux 4.19

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References